Improper Privilege Management in Octopus Deploy

1) Improper Privilege Management

EUVDB-ID: #VU31341

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-9039

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team's scoped environments.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Octopus Deploy: 2018.3.1 - 2018.3.6

External links

http://github.com/OctopusDeploy/Issues/issues/4407
http://octopus.com/downloads/compare?from=2018.3.6&to=2018.3.7

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.