CVE-2019-11632

moderate-risk
Published 2019-05-01

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)

Do I need to act?

-
0.25% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Octopus

References (4)

Exploit https://github.com/OctopusDeploy/Issues/issues/5528
Third Party Advisory https://github.com/OctopusDeploy/Issues/issues/5529
Exploit https://github.com/OctopusDeploy/Issues/issues/5528
Third Party Advisory https://github.com/OctopusDeploy/Issues/issues/5529
36
/ 100
moderate-risk
Severity 28/34 · Critical
Exploitability 1/34 · Minimal
Exposure 7/34 · Low