Description
It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2022.2.5205 – < 2022.2.7934, 2022.3.348 – < 2022.3.9163 | 2022.2.7934 |
Advisories 1
- WID-SEC-2024-0987 Octopus Deploy: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 29, 2024