CVE-2021-31818: SQL Injection
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31818?
CVE-2021-31818 is considered a critical severity vulnerability due to the potential for unauthorized database access.
How do I fix CVE-2021-31818?
To fix CVE-2021-31818, upgrade Octopus Server to a version that contains the patch for the SQL injection vulnerability.
What versions are affected by CVE-2021-31818?
CVE-2021-31818 affects Octopus Server versions between 2018.9.17 and 2018.13.0, 2020.0.0 and 2020.6.0, 2020.6.0 and 2020.6.5146, and 2021.1.0 and 2021.1.7316.
How can CVE-2021-31818 be exploited?
CVE-2021-31818 can be exploited by using specially crafted user input in the Events REST API to execute unauthorized SQL queries.
Who is affected by CVE-2021-31818?
Organizations using the affected versions of Octopus Server are at risk of CVE-2021-31818 and should take immediate action to mitigate the vulnerability.