CVE-2020-12286

In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension

published April 28, 2020

CVSS
—
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00981 · 61.9th percentile
Published
2020-04-28T06:06Z
EPSS history
Timeline
  • 28 APR 06:06Z
    In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension
    cvelistv5