Vulnerability Description
It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Octopus | Octopus Server | >= 2022.2.6729, < 2022.2.7934 |
Related Weaknesses (CWE)
References
- https://advisories.octopus.com/post/2024/SA2024-03/Broken Link
- https://advisories.octopus.com/post/2024/SA2024-03/Broken Link
FAQ
What is CVE-2024-4226?
CVE-2024-4226 is a vulnerability with a CVSS score of 3.5 (LOW). It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Oc...
How severe is CVE-2024-4226?
CVE-2024-4226 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-4226?
Check the references section above for vendor advisories and patch information. Affected products include: Octopus Octopus Server.