PT-2021-19525 · Unknown · Octopus Server

Justin Steven · Published 2021-06-17 · Updated 2022-07-27 · CVE-2021-31818

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Octopus Server (affected versions not specified)

Description The issue is related to an authenticated SQL injection vulnerability in the Events REST API. This occurs because user-supplied data in the API request is not parameterized correctly. Exploiting this vulnerability could allow unauthorized access to database tables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-31818

Affected Products

Octopus Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-31818 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31818 · Vendor Advisory
• https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29.2013233248.html · Note
• https://t.me/cibsecurity/25522 · Telegram Post