PT-2018-16579 · Octopus Deploy · Octopus Deploy

Slewis74 · Publicado 2018-01-03 · Atualizado 2019-10-03 · CVE-2018-4862

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.2.11 through 4.1.5

Description The issue allows an authenticated user with ProcessEdit permission to bypass scoping restrictions by referencing an Azure account in a specific way, potentially leading to an escalation of privileges.

Recommendations For versions 3.2.11 through 4.1.5, update to version 4.1.6 to resolve the issue.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-4862

Produtos afetados

Octopus Deploy

Referências · 3

• https://github.com/OctopusDeploy/Issues/issues/4134 · Nota
• https://osv.dev/vulnerability/CVE-2018-4862 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-4862 · Nota de Segurança