CVE-2024-7998: Low severity octopus deploy vulnerability
Published Aug 21, 2024
·Updated
In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.
Affected Software
5 affected components
Octopus Deploy Octopus Server
All of the following
Any of the following
Octopus Octopus Server>=2022.4.8332<2024.1.12931
Octopus Octopus Server>=2024.2.101<2024.2.9313
Any of the following
Linux Linux kernel
Microsoft Windows
Event History
Aug 21, 2024
CVE Published
via MITRE·05:30 AM
Data Sourced
via MITRE·05:30 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-7998?
CVE-2024-7998 has been rated as a medium severity vulnerability.
2
How do I fix CVE-2024-7998?
To fix CVE-2024-7998, update to the latest version of Octopus Server where the expiration time of OIDC cookies is correctly configured.
3
What versions are affected by CVE-2024-7998?
CVE-2024-7998 affects all versions of Octopus Server prior to the patch addressing the cookie expiration issue.
4
What are the risks associated with CVE-2024-7998?
The main risk of CVE-2024-7998 is that OIDC cookies may remain valid longer than intended, potentially allowing unauthorized access.
5
Is CVE-2024-7998 exploitable in a typical environment?
CVE-2024-7998 may be exploitable depending on the specific configuration and deployment of Octopus Server.