Skip to content

Octopus Deploy vulnerabilities

octopus deploy, octopus deploy server +1 moreIn affected versions of Octopus Deploy it is possible to unmask variable secrets using the...CVE-2023-22475.3 MediumMay 2, 2023
octopus deploy server, octopus deploy +1 moreIn Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled...CVE-2022-20137.5 HighJune 12, 2022
octopus server, deploy +1 moreIn affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to...CVE-2022-231846.1 MediumFebruary 7, 2022
octopus server, deploy +1 moreWhen Octopus Server is installed using a custom folder location, folder ACLs are not set...CVE-2021-265567.8 HighOctober 7, 2021
octopus deployIn Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a...CVE-2020-261616.1 MediumOctober 26, 2020
octopus deployAn issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint...CVE-2020-271557.5 HighOctober 22, 2020
octopus deployIn Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user...CVE-2020-258257.5 HighOctober 12, 2020
octopus deployIn Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user...CVE-2020-245667.5 HighSeptember 9, 2020
octopus deployIn Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could...CVE-2020-144706.5 MediumJune 19, 2020
octopus deployIn Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not...CVE-2020-122864.3 MediumApril 28, 2020
octopus deployIn Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to...CVE-2020-106788.8 HighMarch 19, 2020
octopus deployIn Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a...CVE-2019-193766.5 MediumNovember 28, 2019
octopus deployIn Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF...CVE-2019-193755.3 MediumNovember 28, 2019
octopus deployIn Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to...CVE-2019-190844.3 MediumNovember 18, 2019
octopus deploy, server +1 moreIn Octopus Deploy 2019.4.0 through 2019.6.6 and 2019.7.0 through 2019.7.7, an authenticated...CVE-2019-145254.9 MediumAugust 5, 2019
octopus deployIn Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an...CVE-2019-142686.5 MediumJuly 25, 2019
octopus deploy, server +1 moreIn Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user...CVE-2019-116328.1 HighMay 1, 2019
octopus deploy, server +1 moreAn Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 ...CVE-2019-89446.5 MediumFebruary 20, 2019
octopus deployIn Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions...CVE-2018-128846.5 MediumJune 26, 2018
octopus deployIn Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save...CVE-2018-105815.4 MediumMay 1, 2018
octopus deployIn Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against...CVE-2018-105507.5 HighApril 30, 2018
octopus deployIn Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit...CVE-2018-90396.5 MediumMarch 27, 2018
octopus deployAn issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions...CVE-2018-57068.8 HighJanuary 16, 2018
octopus deployIn Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with...CVE-2018-48628.8 HighJanuary 3, 2018
octopus deployIn Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access...CVE-2017-176658.8 HighDecember 13, 2017
octopus deployCross-site scripting (XSS) vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 ...CVE-2017-168105.4 MediumNovember 14, 2017
octopus deployCross-site scripting (XSS) vulnerability in Octopus Deploy 3.7.0-3.17.13 (fixed in 3.17.14)...CVE-2017-168015.4 MediumNovember 13, 2017
octopus deployIn Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to...CVE-2017-156116.5 MediumOctober 19, 2017
octopus deployAn issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted...CVE-2017-156106.5 MediumOctober 19, 2017
octopus deployOctopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a...CVE-2017-156097.5 HighOctober 19, 2017
octopus deploy, server +1 moreIn Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload...CVE-2017-113485.7 MediumJuly 17, 2017