Octopus: >> Octopus Server >> 2019.4.2 Security Vulnerabilities
In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
CVSS Score
5.3
EPSS Score
0.005
Published
2022-07-19
When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users.
CVSS Score
7.5
EPSS Score
0.009
Published
2022-05-19
In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI.
CVSS Score
7.5
EPSS Score
0.006
Published
2021-08-18
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)
CVSS Score
8.1
EPSS Score
0.012
Published
2019-05-01
Page 4