Vulnerability Description
In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team's scoped environments.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Octopus | Octopus Deploy | >= 2.0, < 2018.3.7 |
Related Weaknesses (CWE)
References
- https://github.com/OctopusDeploy/Issues/issues/4407ExploitThird Party Advisory
- https://octopus.com/downloads/compare?from=2018.3.6&to=2018.3.7Release Notes
- https://github.com/OctopusDeploy/Issues/issues/4407ExploitThird Party Advisory
- https://octopus.com/downloads/compare?from=2018.3.6&to=2018.3.7Release Notes
FAQ
What is CVE-2018-9039?
CVE-2018-9039 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words,...
How severe is CVE-2018-9039?
CVE-2018-9039 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-9039?
Check the references section above for vendor advisories and patch information. Affected products include: Octopus Octopus Deploy.