CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-16197
https://notcve.org/view.php?id=CVE-2020-16197
An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation. Se detectó un problema en Octopus Deploy versión 3.4. • https://github.com/OctopusDeploy/Issues/issues/6529 https://github.com/OctopusDeploy/Issues/issues/6530 https://github.com/OctopusDeploy/Issues/issues/6531 • CWE-295: Improper Certificate Validation •
CVSS: 6.3EPSS: 0%CPEs: 192EXPL: 0CVE-2017-11348
https://notcve.org/view.php?id=CVE-2017-11348
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value. En Octopus Deploy versión 3.x anterior a 3.15.4, un usuario autenticado con permiso PackagePush para cargar paquetes podría cargar un paquete NuGet creado con fines maliciosos, sobrescribiendo potencialmente otros paquetes o modificando archivos del sistema. Esto es un salto de directorio en el valor PackageId. • https://github.com/OctopusDeploy/Issues/issues/3654 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •