Design/Logic Flaw

2021-10-0701:15:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.4%

JSON

When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.

CPENameOperatorVersion
octopus_deployge0.9
octopus_deploylt2020.4.229
octopus_serverge2020.5.0
octopus_serverlt2020.5.256

Name	Operator	Version
octopus_deploy	ge	0.9
octopus_deploy	lt	2020.4.229
octopus_server	ge	2020.5.0
octopus_server	lt	2020.5.256

References

advisories.octopus.com/adv/2021-01---Local-privilege-escalation-in-Octopus-Server-(CVE-2021-26556).1733296189.html