CVE-2018-9039: Medium severity Octopus Octopus Deploy vulnerability
In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team's scoped environments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9039?
The severity of CVE-2018-9039 is considered medium due to its potential to expose sensitive machine information to unauthorized users.
How do I fix CVE-2018-9039?
To fix CVE-2018-9039, upgrade your Octopus Deploy installation to version 2018.3.7 or later.
Who is affected by CVE-2018-9039?
CVE-2018-9039 affects users of Octopus Deploy versions from 2.0 up to 2018.3.6 with variable edit permissions.
What are the implications of CVE-2018-9039?
The implications of CVE-2018-9039 allow authenticated users to view machines beyond the permissions of their team’s scoped environments.
Is CVE-2018-9039 a zero-day vulnerability?
CVE-2018-9039 is not a zero-day vulnerability as it was reported and patched after the affected versions were released.