Описание
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.5 (включая) до 2022.1.3264 (исключая)Версия от 2022.2.6729 (включая) до 2022.2.8277 (исключая)Версия от 2022.3.348 (включая) до 2022.3.10586 (исключая)Версия от 2022.4.791 (включая) до 2022.4.2898 (исключая)
Одно из
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
EPSS
Процентиль: 60%
0.00392
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-287
CWE-287
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
EPSS
Процентиль: 60%
0.00392
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-287
CWE-287