CVE-2017-15611: Medium severity Octopus Octopus Deploy vulnerability
Published Oct 19, 2017
·Updated
In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.
Affected Software
1 affected component
Octopus Octopus Deploy<=3.17.6
Remediation
Patch Available
Event History
Oct 19, 2017
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-15611?
CVE-2017-15611 is classified as a medium severity vulnerability.
2
How do I fix CVE-2017-15611?
To fix CVE-2017-15611, upgrade Octopus Deploy to version 3.17.7 or later.
3
Who is affected by CVE-2017-15611?
CVE-2017-15611 affects users of Octopus Deploy versions prior to 3.17.7 that have UserInvite permissions.
4
What is the impact of CVE-2017-15611?
The impact of CVE-2017-15611 is that an authenticated user can invite others with escalated privileges to teams.
5
When was CVE-2017-15611 publicly disclosed?
CVE-2017-15611 was publicly disclosed in November 2017.