CVE-2020-16197: Medium severity octopus deploy vulnerability

Published Aug 25, 2020

Updated

An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation.

Affected Software

2 affected components

Octopus Octopus Server=3.4.0

Octopus Server=3.4.0

Event History

Aug 25, 2020

CVE Published

via MITRE·06:51 PM

Data Sourced

via MITRE·06:51 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-16197?

The severity of CVE-2020-16197 is rated as medium with a CVSS score of 4.3.

How can I fix the issue in Octopus Deploy 3.4 related to CVE-2020-16197?

To fix the vulnerability in Octopus Deploy 3.4 related to CVE-2020-16197, apply the patches provided by Octopus Deploy or upgrade to a non-vulnerable version.

Is there any workaround available for CVE-2020-16197 in Octopus Deploy 3.4?

At this time, there are no known workarounds for the vulnerability in Octopus Deploy 3.4 related to CVE-2020-16197.