CVE-2020-16197 — MEDIUM (4.3)

Vulnerability Description

An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Octopus	Octopus Server	3.4.0
Octopus	Server	3.4.0

Related Weaknesses (CWE)

CWE-295

References

https://github.com/OctopusDeploy/Issues/issues/6529Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6530Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6531Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6529Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6530Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6531Third Party Advisory

FAQ

What is CVE-2020-16197?

CVE-2020-16197 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potential...

How severe is CVE-2020-16197?

CVE-2020-16197 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-16197?

Check the references section above for vendor advisories and patch information. Affected products include: Octopus Octopus Server, Octopus Server.