PT-2017-14570 · Octopus Deploy · Octopus Deploy

Michaelnoonan · Publicado 2017-11-13 · Atualizado 2017-12-01 · CVE-2017-16801

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.7.0 through 3.17.13

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. This could potentially lead to unauthorized actions on the affected system.

Recommendations For versions 3.7.0 through 3.17.13, update to version 3.17.14 to resolve the issue. As a temporary workaround, consider restricting access to the Step Template Name parameter until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16801

Produtos afetados

Octopus Deploy

Referências · 3

• https://github.com/OctopusDeploy/Issues/issues/3915 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16801 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16801 · Aviso do Fabricante