Vulnerability Description
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Octopus | Octopus Deploy | >= 3.4.0, < 2018.4.7 |
Related Weaknesses (CWE)
References
- https://github.com/OctopusDeploy/Issues/issues/4474ExploitThird Party Advisory
- https://github.com/OctopusDeploy/Issues/issues/4474ExploitThird Party Advisory
FAQ
What is CVE-2018-10581?
CVE-2018-10581 is a vulnerability with a CVSS score of 5.4 (MEDIUM). In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated T...
How severe is CVE-2018-10581?
CVE-2018-10581 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10581?
Check the references section above for vendor advisories and patch information. Affected products include: Octopus Octopus Deploy.