Lucene search

OctopusVULNRICHMENT:CVE-2024-2975

HistoryApr 09, 2024 - 1:02 a.m.

CVE-2024-2975

2024-04-0901:02:46

Octopus

github.com

race condition

privilege escalation

configuration

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

A race condition was identified through which privilege escalation was possible in certain configurations.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "Octopus Server",
    "vendor": "Octopus Deploy",
    "versions": [
      {
        "lessThan": "2023.4.8432",
        "status": "affected",
        "version": "0.9",
        "versionType": "custom"
      },
      {
        "lessThan": "2024.1.12087",
        "status": "affected",
        "version": "2024.1.437",
        "versionType": "custom"
      },
      {
        "lessThan": "2024.2.2075",
        "status": "affected",
        "version": "2024.2.101",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/post/2024/sa2024-01/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for VULNRICHMENT:CVE-2024-2975