CVE-2024-4456: XSS
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.
Other sources
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4456?
CVE-2024-4456 is considered a high severity vulnerability due to the potential for Cross-Site Scripting and exposure of sensitive information.
How do I fix CVE-2024-4456?
To fix CVE-2024-4456, update to the latest version of Octopus Server that addresses this vulnerability.
What systems are affected by CVE-2024-4456?
CVE-2024-4456 affects certain versions of Octopus Server and the Octopus Kubernetes worker or agent.
What are the risks associated with CVE-2024-4456?
The risks associated with CVE-2024-4456 include potential Cross-Site Scripting attacks and unauthorized exposure of sensitive variables in logs.
Is there a workaround for CVE-2024-4456 until I can apply the fix?
Currently, there are no recommended workarounds for CVE-2024-4456, so applying the update is necessary to mitigate the risk.