OD
Product
Octopus Deploy
31
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 12Medium 19Low 0
Watch
Add Octopus Deploy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-14470 | 6.5 | Jun 19 | In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password Affected: 2018.8.0 before 2019.12.2 |
| CVE-2019-19376 | 6.5 | Nov 28 | In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application… Affected: before 2019.10.7; 2019.6.0 before 2019.6.14; 2019.9.0 before 2019.9.8 |
| CVE-2019-14268 | 6.5 | Jul 25 | In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a deployment that… Affected: 3.0.19 through 2019.7.2 |
| CVE-2019-8944 | 6.5 | Feb 20 | An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive… Affected: through 2018.9.17; 2018.10.0; 2018.10.1; 2018.10.2; 2018.10.3 |
| CVE-2018-12884 | 6.5 | Jun 26 | In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu Affected: 3.0 |
| CVE-2018-9039 | 6.5 | Mar 27 | In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should… Affected: 2.0 before 2018.3.7 |
| CVE-2017-15611 | 6.5 | Oct 19 | In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges Affected: through 3.17.6 |
| CVE-2017-15610 | 6.5 | Oct 19 | An issue was discovered in Octopus before 3.17.7 Affected: through 3.17.6 |
| CVE-2022-23184 | 6.1 | Feb 7 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects Affected: 0.9 through 4.1.10; 2018.1.0 through 2020.1.1 |
| CVE-2020-26161 | 6.1 | Oct 26 | In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header Affected: 2019.8.2 through 2020.4.2 |
| CVE-2017-11348 | 5.7 | Jul 17 | In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting… Affected: 3.6.0; 3.7.0 |
| CVE-2018-10581 | 5.4 | May 1 | In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist… Affected: 3.4.0 before 2018.4.7 |
| CVE-2017-16810 | 5.4 | Nov 14 | Cross-site scripting (XSS) vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 (fixed in 3.13.7) allows remote attackers to inject arbitrary web script or HTML… Affected: 3.4.0 through 3.13.6 |
| CVE-2017-16801 | 5.4 | Nov 13 | Cross-site scripting (XSS) vulnerability in Octopus Deploy 3.7.0-3.17.13 (fixed in 3.17.14) allows remote authenticated users to inject arbitrary web script or HTML via the Step… Affected: 3.7.0 through 3.17.3 |
| CVE-2023-2247 | 5.3 | May 2 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function Affected: 2018.3.0 before 2022.3.10929; 2022.4.0 before 2022.4.8319 |
| CVE-2019-19375 | 5.3 | Nov 28 | In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute Affected: before 2019.10.7; 2019.6.0 before 2019.6.14; 2019.9.0 before 2019.9.8 |
| CVE-2019-14525 | 4.9 | Aug 5 | In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a… Affected: 2019.4.0 before 2019.6.6 |
| CVE-2020-12286 | 4.3 | Apr 28 | In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension Affected: before 2019.12.9; 2020.1 before 2020.1.12 |
| CVE-2019-19084 | 4.3 | Nov 18 | In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception… Affected: 3.3.0 through 2019.10.4 |
Showing 19