Information disclosure in Octopus Deploy - CVE-2018-10581
Published: May 1, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31313
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-10581
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Octopus Deploy
Affected software:
Octopus Deploy
Octopus Deploy
Detailed vulnerability description
The vulnerability allows a remote authenticated user to read and manipulate data.
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
How to mitigate CVE-2018-10581
Install update from vendor's website.