CVE-2019-11632

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. These permissions are only used in custom...

CVE-2019-11632

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. These permissions are only used in custom...

CVE-2019-11632

The CVE-2019-11632 issue affects Octopus Deploy versions 2019.1.0–2019.3.1 and 2019.4.0–2019.4.5. An authenticated user who has VariableViewUnscoped or VariableEditUnscoped permissions scoped to a single project can view or edit unscoped variables from a different project. This is tied to the way...

PT-2019-12438

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2019.1.0 through 2019.3.1 Octopus Deploy versions 2019.4.0 through 2019.4.5 Description The issue allows an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission to view or edit unscoped...

CVE-2019-11632: Improper Privilege Management

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. These permissions are only used in custom...

octopusdeploy stores credentials in plain text

octopusdeploy stores credentials unencrypted in its global configuration file hudson.plugins.octopusdeploy.OctopusDeployPlugin.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

CVE-2019-8944

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 and before 2018.10.4 LTS allows remote authenticated users to view sensitive Terraform output variables via log files...

Information disclosure

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 and before 2018.10.4 LTS allows remote authenticated users to view sensitive Terraform output variables via log files...

CVE-2019-8944

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 and before 2018.10.4 LTS allows remote authenticated users to view sensitive Terraform output variables via log files...

CVE-2019-8944

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 and before 2018.10.4 LTS allows remote authenticated users to view sensitive Terraform output variables via log files...

CVE-2019-8944

The CVE-2019-8944 entry concerns Octopus Deploy’s Terraform deployment step prior to 2019.1.8 (and before 2018.10.4 LTS), where remote authenticated users can view sensitive Terraform output variables via log files. The affected component is the Terraform deployment step; root cause is informatio...

PT-2019-19275

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 2018.10.4 LTS Octopus Deploy versions prior to 2019.1.8 Description An Information Exposure issue in the Terraform deployment step allows remote authenticated users to view sensitive Terraform output variables...

CVE-2019-8944: Insertion of Sensitive Information into Log File

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 and before 2018.10.4 LTS allows remote authenticated users to view sensitive Terraform output variables via log files...

Design/Logic Flaw

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy, CVE-2018-18850 affects versions 2018.8.0 through 2018.9.x before 2018.9.1. An authenticated user with permission to modify deployment processes could upload a malicious YAML configuration, potentially allowing remote code execution within the Octopus Server process (often SYSTE...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850: Undefined Security Weakness

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

PT-2018-14689

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2018.8.0 through 2018.9.0 Description The issue allows an authenticated user with permission to modify deployment processes to upload a maliciously crafted YAML configuration. This could potentially allow for remote...