Vulnerability Details CVE-2021-31818
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 39.8%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
Products affected by CVE-2021-31818
-
cpe:2.3:a:octopus:server:*
-
cpe:2.3:a:octopus:server:2020.1.0
-
cpe:2.3:a:octopus:server:2020.1.11
-
cpe:2.3:a:octopus:server:2020.1.12
-
cpe:2.3:a:octopus:server:2020.1.13
-
cpe:2.3:a:octopus:server:2020.1.14
-
cpe:2.3:a:octopus:server:2020.1.15
-
cpe:2.3:a:octopus:server:2020.1.16
-
cpe:2.3:a:octopus:server:2020.1.17
-
cpe:2.3:a:octopus:server:2020.1.18
-
cpe:2.3:a:octopus:server:2020.1.19
-
cpe:2.3:a:octopus:server:2020.1.2
-
cpe:2.3:a:octopus:server:2020.1.20
-
cpe:2.3:a:octopus:server:2020.1.21
-
cpe:2.3:a:octopus:server:2020.1.22
-
cpe:2.3:a:octopus:server:2020.1.3
-
cpe:2.3:a:octopus:server:2020.1.4
-
cpe:2.3:a:octopus:server:2020.1.5
-
cpe:2.3:a:octopus:server:2020.2.1
-
cpe:2.3:a:octopus:server:2020.2.10
-
cpe:2.3:a:octopus:server:2020.2.11
-
cpe:2.3:a:octopus:server:2020.2.12
-
cpe:2.3:a:octopus:server:2020.2.13
-
cpe:2.3:a:octopus:server:2020.2.14
-
cpe:2.3:a:octopus:server:2020.2.15
-
cpe:2.3:a:octopus:server:2020.2.16
-
cpe:2.3:a:octopus:server:2020.2.17
-
cpe:2.3:a:octopus:server:2020.2.18
-
cpe:2.3:a:octopus:server:2020.2.19
-
cpe:2.3:a:octopus:server:2020.2.20
-
cpe:2.3:a:octopus:server:2020.2.8
-
cpe:2.3:a:octopus:server:2020.2.9
-
cpe:2.3:a:octopus:server:2020.3.10
-
cpe:2.3:a:octopus:server:2020.3.4
-
cpe:2.3:a:octopus:server:2020.3.5
-
cpe:2.3:a:octopus:server:2020.3.6
-
cpe:2.3:a:octopus:server:2020.3.7
-
cpe:2.3:a:octopus:server:2020.3.8
-
cpe:2.3:a:octopus:server:2020.3.9
-
cpe:2.3:a:octopus:server:2020.4.0
-
cpe:2.3:a:octopus:server:2020.4.1
-
cpe:2.3:a:octopus:server:2020.4.10
-
cpe:2.3:a:octopus:server:2020.4.11
-
cpe:2.3:a:octopus:server:2020.4.12
-
cpe:2.3:a:octopus:server:2020.4.13
-
cpe:2.3:a:octopus:server:2020.4.14
-
cpe:2.3:a:octopus:server:2020.4.2
-
cpe:2.3:a:octopus:server:2020.4.229
-
cpe:2.3:a:octopus:server:2020.4.272
-
cpe:2.3:a:octopus:server:2020.4.3
-
cpe:2.3:a:octopus:server:2020.4.4
-
cpe:2.3:a:octopus:server:2020.4.5
-
cpe:2.3:a:octopus:server:2020.4.6
-
cpe:2.3:a:octopus:server:2020.4.9
-
cpe:2.3:a:octopus:server:2020.5.0
-
cpe:2.3:a:octopus:server:2020.5.1
-
cpe:2.3:a:octopus:server:2020.5.2
-
cpe:2.3:a:octopus:server:2020.5.239
-
cpe:2.3:a:octopus:server:2020.5.249
-
cpe:2.3:a:octopus:server:2020.5.256
-
cpe:2.3:a:octopus:server:2020.5.266
-
cpe:2.3:a:octopus:server:2020.5.271
-
cpe:2.3:a:octopus:server:2020.5.273
-
cpe:2.3:a:octopus:server:2020.5.3
-
cpe:2.3:a:octopus:server:2020.5.303
-
cpe:2.3:a:octopus:server:2020.5.353
-
cpe:2.3:a:octopus:server:2020.5.379
-
cpe:2.3:a:octopus:server:2020.5.4
-
cpe:2.3:a:octopus:server:2020.5.5
-
cpe:2.3:a:octopus:server:2020.5.6
-
cpe:2.3:a:octopus:server:2020.5.7
-
cpe:2.3:a:octopus:server:2020.5.8
-
cpe:2.3:a:octopus:server:2020.5.9
-
cpe:2.3:a:octopus:server:2020.6.4671
-
cpe:2.3:a:octopus:server:2020.6.4688
-
cpe:2.3:a:octopus:server:2020.6.4701
-
cpe:2.3:a:octopus:server:2020.6.4722
-
cpe:2.3:a:octopus:server:2020.6.4788
-
cpe:2.3:a:octopus:server:2020.6.4809
-
cpe:2.3:a:octopus:server:2020.6.4855
-
cpe:2.3:a:octopus:server:2020.6.4915
-
cpe:2.3:a:octopus:server:2020.6.4923
-
cpe:2.3:a:octopus:server:2020.6.4974
-
cpe:2.3:a:octopus:server:2020.6.4987
-
cpe:2.3:a:octopus:server:2020.6.5030
-
cpe:2.3:a:octopus:server:2020.6.5051
-
cpe:2.3:a:octopus:server:2020.6.5083
-
cpe:2.3:a:octopus:server:2020.6.5094
-
cpe:2.3:a:octopus:server:2021.1.6959
-
cpe:2.3:a:octopus:server:2021.1.7149
-
cpe:2.3:a:octopus:server:2021.1.7198
-
cpe:2.3:a:octopus:server:2021.1.7236