SB2018032709 - Improper Privilege Management in Octopus Deploy
Published: March 27, 2018 Updated: July 17, 2020
Security Bulletin ID
SB2018032709
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Privilege Management (CVE-ID: CVE-2018-9039)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team's scoped environments.
Remediation
Install update from vendor's website.