CVE-2020-27155

Опубликовано: 22 окт. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 4.3

EPSS Низкий

Описание

An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one.

Ссылки

https://github.com/OctopusDeploy
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6637
Issue Tracking
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6639
Issue Tracking
Patch
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6640
Issue Tracking
Patch
Third Party Advisory
https://github.com/OctopusDeploy
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6637
Issue Tracking
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6639
Issue Tracking
Patch
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/6640
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:*:*:*:*

Версия от 3.11.13 (включая) до 2020.4.4 (включая)

EPSS

Процентиль: 59%

0.00383

Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-cc7m-766r-4r2f

github

больше 3 лет назад