Summary
Ein Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen und einen Cross-Site-Scripting-Angriff durchzuführen.
Product
Octopus Deploy ist ein automatisierter Software-Bereitstellungs- und Release-Management-Server.
Vulnerabilities 4
-
Medium 5.9
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all s…
-
Low 2.3
In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a tar…
-
Low 2.3
In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API…
-
Low 1.8
In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could co…
Revision history
-
#1
Initiale Fassung
References
-
Octopus Security Advisory vom 2025-02-10
https://advisories.octopus.com/post/2025/sa2025-02/
-
Octopus Security Advisory vom 2025-02-10
https://advisories.octopus.com/post/2025/sa2025-03/
-
Octopus Security Advisory vom 2025-02-10
https://advisories.octopus.com/post/2025/sa2025-04/
-
Octopus Security Advisory vom 2025-02-10
https://advisories.octopus.com/post/2025/sa2025-05/