CVE-2024-4226

EUVD-2024-32778 · Published Apr 30, 2024

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.

Technologies

Octopus Octopus Server

Weaknesses

CWE-276

CVSS scores

v3.13.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth Discovery

T1190Exploit Public-Facing Application T1083File and Directory Discovery T1574.010Services File Permissions Weakness

References

https://advisories.octopus.com/post/2024/SA2024-03/

Potentially impacted assets

See if this affects your attack surface