CVE-2020-12286

In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant...

CVE-2020-12286

CVE-2020-12286 describes an information-disclosure vulnerability in Octopus Deploy where the TaskView permission is not scoped to any dimension. In versions before 2019.12.9 and before 2020.1.12, a user scoped to a single tenant could view server tasks for other tenants, indicating a missing scop...