CVE-2019-11632: High severity octopus deploy vulnerability
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11632?
CVE-2019-11632 has a medium severity rating due to its impact on information disclosure and variable manipulation.
How do I fix CVE-2019-11632?
To fix CVE-2019-11632, update Octopus Deploy to version 2019.4.6 or later which addresses this vulnerability.
Who is affected by CVE-2019-11632?
CVE-2019-11632 affects authenticated users of Octopus Deploy versions between 2019.1.0 and 2019.4.5 with specific variable permissions scoped to projects.
What impact does CVE-2019-11632 have?
CVE-2019-11632 allows an authenticated user to view or edit unscoped variables across different projects, which may lead to unauthorized access or data manipulation.
Is there a workaround for CVE-2019-11632?
A temporary workaround for CVE-2019-11632 is to restrict the use of the VariableViewUnscoped and VariableEditUnscoped permissions until an upgrade can be applied.