CVE-2018-10550: High severity octopus deploy vulnerability
Published Apr 30, 2018
·Updated
In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to.
Affected Software
1 affected component
Octopus Octopus Deploy<2018.4.7
Event History
Apr 30, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-10550?
CVE-2018-10550 has a medium severity rating, as it can lead to unauthorized access to tenant-specific variable scopes.
2
How do I fix CVE-2018-10550?
To fix CVE-2018-10550, upgrade Octopus Deploy to version 2018.4.7 or later.
3
What versions of Octopus Deploy are affected by CVE-2018-10550?
CVE-2018-10550 affects all versions of Octopus Deploy prior to 2018.4.7.
4
What type of vulnerability is CVE-2018-10550?
CVE-2018-10550 is an access control vulnerability related to tenant tag variable scopes.
5
Who is impacted by CVE-2018-10550?
Users of Octopus Deploy before version 2018.4.7 who manage tenant tag variable scopes may be impacted by CVE-2018-10550.