CVE-2017-15610: Infoleak
An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15610?
CVE-2017-15610 has a high severity rating due to the potential for unauthorized access to sensitive certificate data.
How do I fix CVE-2017-15610?
To fix CVE-2017-15610, upgrade Octopus Deploy to version 3.17.7 or later to remove the CertificateExportPrivateKey permission from the Guest user account.
What systems are affected by CVE-2017-15610?
CVE-2017-15610 affects Octopus Deploy versions prior to 3.17.7.
What action should be taken if Guest Access is enabled and CVE-2017-15610 is present?
If Guest Access is enabled and CVE-2017-15610 is present, disable Guest Access until the software is updated to a secure version.
Who can exploit CVE-2017-15610?
An attacker can exploit CVE-2017-15610 by signing in as the Guest account when it has been improperly granted the CertificateExportPrivateKey permission.