CVE-2024-4226: Low severity Octopus Deploy Octopus Server vulnerability
It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4226?
CVE-2024-4226 has a medium severity rating due to unauthorized access to user roles and permissions.
How do I fix CVE-2024-4226?
To fix CVE-2024-4226, upgrade to the latest version of Octopus Server where the vulnerability has been addressed.
Which versions of Octopus Server are affected by CVE-2024-4226?
CVE-2024-4226 affects certain earlier versions of Octopus Server prior to the fixed versions listed in the advisories.
What data can unauthorized users access due to CVE-2024-4226?
Unauthorized users can access all users, user roles, and permissions in Octopus Server due to CVE-2024-4226.
Was CVE-2024-4226 confirmed in all versions of Octopus Server?
No, CVE-2024-4226 was specifically confirmed in certain versions of Octopus Server prior to the release of the patch.