What is the severity of CVE-2019-11632?

CVE-2019-11632 has a medium severity rating due to its impact on information disclosure and variable manipulation.

How do I fix CVE-2019-11632?

To fix CVE-2019-11632, update Octopus Deploy to version 2019.4.6 or later which addresses this vulnerability.

Who is affected by CVE-2019-11632?

CVE-2019-11632 affects authenticated users of Octopus Deploy versions between 2019.1.0 and 2019.4.5 with specific variable permissions scoped to projects.

What impact does CVE-2019-11632 have?

CVE-2019-11632 allows an authenticated user to view or edit unscoped variables across different projects, which may lead to unauthorized access or data manipulation.

Is there a workaround for CVE-2019-11632?

A temporary workaround for CVE-2019-11632 is to restrict the use of the VariableViewUnscoped and VariableEditUnscoped permissions until an upgrade can be applied.

Vulnerability/
CVE-2019-11632

high

8.1

CWE

269

1/5/2019

4/8/2024

CVE-2019-11632

First published: Wed May 01 2019(Updated: )

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Octopus Deploy	>=2019.1.0<=2019.3.1
Octopus Deploy	>=2019.4.0<=2019.4.5

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2019-11632?
CVE-2019-11632 has a medium severity rating due to its impact on information disclosure and variable manipulation.
How do I fix CVE-2019-11632?
To fix CVE-2019-11632, update Octopus Deploy to version 2019.4.6 or later which addresses this vulnerability.
Who is affected by CVE-2019-11632?
CVE-2019-11632 affects authenticated users of Octopus Deploy versions between 2019.1.0 and 2019.4.5 with specific variable permissions scoped to projects.
What impact does CVE-2019-11632 have?
CVE-2019-11632 allows an authenticated user to view or edit unscoped variables across different projects, which may lead to unauthorized access or data manipulation.
Is there a workaround for CVE-2019-11632?
A temporary workaround for CVE-2019-11632 is to restrict the use of the VariableViewUnscoped and VariableEditUnscoped permissions until an upgrade can be applied.

agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/author
agent/weakness
agent/description
agent/event
agent/first-publish-date
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/octopus
canonical/octopus deploy
version/octopus deploy/2019.1.0
version/octopus deploy/2019.3.1
version/octopus deploy/2019.4.0
version/octopus deploy/2019.4.5

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.