Code injection

2017-10-1908:29:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.

CPENameOperatorVersion
octopus_deployle3.17.6

CPE	Name	Operator	Version
	octopus_deploy	le	3.17.6

References

github.com/OctopusDeploy/Issues/issues/3864