#VU31313 Information disclosure in Octopus Deploy - CVE-2018-10581
Published: May 1, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31313
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-10581
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Octopus Deploy
Octopus Deploy
Software vendor:
Octopus Deploy
Octopus Deploy
Description
The vulnerability allows a remote authenticated user to read and manipulate data.
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
Remediation
Install update from vendor's website.