Unscored CVE-2021-26557 EUVD-2021-13356GHSA-jjvc-94pp-59jx

When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user…

Published Oct 7, 2021 · Updated Aug 3, 2024 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Tentacle

Description

When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.

Affected products

Vendor	Product	Affected	Fixed
Octopus Deploy	Octopus Tentacle	3.15.4 – < unspecified, unspecified – < 6.0.489	unspecified

References

https://advisories.octopus.com/adv/2021-02---Local-privilege-escalation-in-Octopus-Tentacle-%28CVE-2021-26557%29.1732870264.html