Octopus Deploy Octopus Server vulnerabilities

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space,…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably…

Octopus Deploy · Octopus Server

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for…

Octopus Deploy · Octopus Server

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary…

Octopus Deploy · Octopus Server