SB2018043011 - Multiple vulnerabilities in Octopus Deploy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018043011

SB2018043011 - Multiple vulnerabilities in Octopus Deploy

Published: April 30, 2018 Updated: July 17, 2020

Security Bulletin ID SB2018043011
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2018-10581)

The vulnerability allows a remote authenticated user to read and manipulate data.

In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.


2) Improper Privilege Management (CVE-ID: CVE-2018-10550)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to.


Remediation

Install update from vendor's website.

References