Low WID-SEC-2023-0626 2 CVEs

Octopus Deploy: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Mar 12, 2023 · Updated Mar 12, 2023 · de-DE

Vendor: Octopus Deploy Product: Octopus Deploy Product: Octopus Deploy < 2022.3.11098 Product: Octopus Deploy < 2022.4.8463 Product: Octopus Deploy < 2023.1.9672 Product: Octopus Deploy < 2023.2.2394 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Informationen offenzulegen.

Product

Octopus Deploy ist ein automatisierter Software-Bereitstellungs- und Release-Management-Server.

Vulnerabilities 2

Medium 4.3

CVE-2022-2258

In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned perm…

Octopus Deploy Octopus Server

Mar 13, 2023
Medium 4.3

CVE-2022-2259

In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned …

Octopus Deploy Octopus Server

Mar 13, 2023

Revision history

2023-03-12 #1
Initiale Fassung

References

Octopus Deploy Security Advisory vom 2023-03-13
https://advisories.octopus.com/post/2023/sa2023-04/
Octopus Deploy Security Advisory vom 2023-03-13
https://advisories.octopus.com/post/2023/sa2023-03/