OD
Product
Octopus Deploy
31
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 12Medium 19Low 0
Watch
Add Octopus Deploy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-10678 | 8.8 | Mar 19 | In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate… Affected: before 2020.1.5 |
| CVE-2018-5706 | 8.8 | Jan 16 | An issue was discovered in Octopus Deploy before 4.1.9 Affected: before 4.1.9 |
| CVE-2018-4862 | 8.8 | Jan 3 | In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure account in such a way as to bypass the… Affected: 3.2.11 through 4.1.5 |
| CVE-2017-17665 | 8.8 | Dec 13 | In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments Affected: before 4.1.3 |
| CVE-2019-11632 | 8.1 | May 1 | In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a… Affected: 2019.1.0 through 2019.3.1 |
| CVE-2021-26556 | 7.8 | Oct 7 | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged… Affected: 0.9 before 2020.4.229 |
| CVE-2022-2013 | 7.5 | Jun 12 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script… Affected: 2022.1.1495 before 2022.1.2647 |
| CVE-2020-27155 | 7.5 | Oct 22 | An issue was discovered in Octopus Deploy through 2020.4.4 Affected: 3.11.13 through 2020.4.4 |
| CVE-2020-25825 | 7.5 | Oct 12 | In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs Affected: 3.1.0 through 2020.4.0 |
| CVE-2020-24566 | 7.5 | Sep 9 | In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's… Affected: 2020.3 before 2020.3.4 |
| CVE-2018-10550 | 7.5 | Apr 30 | In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to Affected: before 2018.4.7 |
| CVE-2017-15609 | 7.5 | Oct 19 | Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets Affected: through 3.17.6 |
Showing 12