CVE-2019-11632

The CVE-2019-11632 issue affects Octopus Deploy versions 2019.1.0–2019.3.1 and 2019.4.0–2019.4.5. An authenticated user who has VariableViewUnscoped or VariableEditUnscoped permissions scoped to a single project can view or edit unscoped variables from a different project. This is tied to the way...

CVE-2019-11632: Improper Privilege Management

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. These permissions are only used in custom...

PT-2019-12438

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2019.1.0 through 2019.3.1 Octopus Deploy versions 2019.4.0 through 2019.4.5 Description The issue allows an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission to view or edit unscoped...