High WID-SEC-2023-1893 2 CVEs

Octopus Deploy: Mehrere Schwachstellen

Published Jul 26, 2023 · Updated Jul 26, 2023 · de-DE

Vendor: Octopus Deploy Product: Octopus Deploy Product: Octopus Deploy < 2022.4.9997 Product: Octopus Deploy < 2023.1.10235 Product: Octopus Deploy < 2023.2.10545 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann diese Schwachstellen in Octopus Deploy ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen preiszugeben

Product

Octopus Deploy ist ein automatisierter Software-Bereitstellungs- und Release-Management-Server.

Vulnerabilities 2

Medium 5.5

CVE-2022-2346

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoi…

Octopus Deploy Octopus Server

Aug 2, 2023
Medium 5.5

CVE-2022-2416

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows en…

Octopus Deploy Octopus Server

Aug 2, 2023

Revision history

2023-07-26 #1
Initiale Fassung

References

Octopus Deploy Security Advisory 2023-10 vom 2023-07-26
https://advisories.octopus.com/post/2023/sa2023-11/
Octopus Deploy Security Advisory 2023-10 vom 2023-07-26
https://advisories.octopus.com/post/2023/sa2023-10/