CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-2247
https://notcve.org/view.php?id=CVE-2023-2247
02 May 2023 — In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function • https://advisories.octopus.com/post/2023/sa2023-07 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26556
https://notcve.org/view.php?id=CVE-2021-26556
07 Oct 2021 — When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access. Cuando Octopus Server se instala usando una ubicación de carpeta personalizada, las ACL de carpeta no se establecen correctamente y podrían conllevar a que un usuario no privilegiado use una carga lateral de DLL para conseguir acceso privilegiado • https://advisories.octopus.com/adv/2021-01---Local-privilege-escalation-in-Octopus-Server-%28CVE-2021-26556%29.1733296189.html • CWE-426: Untrusted Search Path •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26161
https://notcve.org/view.php?id=CVE-2020-26161
26 Oct 2020 — In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. En Octopus Deploy versiones hasta 2020.4.2, un atacante podría redireccionar a usuarios a un sitio externo por medio de un encabezado HTTP Host modificado • https://github.com/OctopusDeploy • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27155
https://notcve.org/view.php?id=CVE-2020-27155
22 Oct 2020 — An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one. Se detectó un problema en Octopus Deploy versiones hasta 2020.4.4. Si está habilitado, el endpoint websocket puede permitir a un host de tentacle no confiable presentarse como uno confiable • https://github.com/OctopusDeploy •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25825
https://notcve.org/view.php?id=CVE-2020-25825
12 Oct 2020 — In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. En Octopus Deploy versiones 3.1.0 hasta 2020.4.0, determinados scripts pueden revelar información confidencial al usuario en los registros de tareas • https://github.com/OctopusDeploy/Issues/issues/6604 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2020-24566
https://notcve.org/view.php?id=CVE-2020-24566
09 Sep 2020 — In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then (under certain circumstances) the account password is exposed in cleartext in the verbose task logs output. En Octopus Deploy versiones 2020.3.x anteriores a 2020.3.4 y versiones 2020.4.x anteriores a 2020.4.1, si un usuario autenticado crea un proceso de implementación o runbook us... • https://github.com/OctopusDeploy/Issues/issues/6563 • CWE-532: Insertion of Sensitive Information into Log File •