CVE-2017-17665

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments

published December 13, 2017

CVSS
—
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01138 · 66.1th percentile
Published
2017-12-13T20:00Z
EPSS history
Timeline
  • 13 DEC 20:00Z
    In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments
    cvelistv5