CVE-2021-31818

2021-06-1713:22:17

Octopus

www.cve.org

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.

CNA Affected

[
  {
    "product": "Octopus Server",
    "vendor": "Octopus Deploy",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2018.9.17",
        "versionType": "custom"
      },
      {
        "lessThan": "2020.6.5146",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2021.1.7149",
        "versionType": "custom"
      },
      {
        "lessThan": "2021.1.7316",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]