CVE-2020-12286

Опубликовано: 28 апр. 2020

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant.

Ссылки

https://github.com/OctopusDeploy/Issues/issues/6331
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6332
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6333
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6331
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6332
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6333
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:*:*:*:*

Версия до 2019.12.9 (исключая)

cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:*:*:*:*

Версия от 2020.1 (включая) до 2020.1.12 (исключая)

EPSS

Процентиль: 60%

0.0039

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-rc37-f48c-29w9

github

больше 3 лет назад