CVE-2024-4226

LOW

Octopus Server 2022.2.6729-2022.2.7934 - Unauthenticated User Enumeration and Permission Exposure

Title source: llm

Description

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.

References (1)

Core 1

Core References

Broken Link

https://advisories.octopus.com/post/2024/SA2024-03/

Scores

CVSS v3 3.5

EPSS 0.0030

EPSS Percentile 21.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-276

Status published

Products (1)

octopus/octopus_server 2022.2.6729 - 2022.2.7934

Published Apr 30, 2024

Tracked Since Feb 18, 2026