Skip to content
OpenAdvisories
Unscored CVE-2021-31818 EUVD-2021-18694GHSA-6jqc-mwfj-6xjc

Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied …

Published Jun 17, 2021 · Updated Aug 3, 2024 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Server

Description

Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.

Affected products

VendorProductAffectedFixed
Octopus Deploy Octopus Server 2018.9.17 – < unspecified, unspecified – < 2020.6.5146, 2021.1.7149 – < unspecified, unspecified – < 2021.1.7316 unspecified

References