Description
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/OctopusDeploy/Issues/issues/4474
Scores
CVSS v3
5.4
EPSS
0.0074
EPSS Percentile
50.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-200
Status
published
Products (1)
octopus/octopus_deploy
3.4.0 - 2018.4.7
Published
May 01, 2018
Tracked Since
Feb 18, 2026