Directory traversal

2017-07-1713:18:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

JSON

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.

CPENameOperatorVersion
octopus_deployeq3.6.0
octopus_deployeq3.7.0
octopus_servereq3.0.6
octopus_servereq3.0.12
octopus_servereq3.0.4
octopus_servereq3.0.18
octopus_servereq3.0.13
octopus_servereq3.0.20
octopus_servereq3.0.19
octopus_servereq3.0.11

Name	Operator	Version
octopus_deploy	eq	3.6.0
octopus_deploy	eq	3.7.0
octopus_server	eq	3.0.6
octopus_server	eq	3.0.12
octopus_server	eq	3.0.4
octopus_server	eq	3.0.18
octopus_server	eq	3.0.13
octopus_server	eq	3.0.20
octopus_server	eq	3.0.19
octopus_server	eq	3.0.11