← Back

CVE-2024-4226

nvd nist
Published: Apr 30, 2024Modified: Jun 17, 2026

JSON object

Loading...
3.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Exploitability: 2.1 / Impact: 1.4
Source: security@octopus.com (Secondary)

Description

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.

Affected (2)

Octopus
1 product
Octopus Server
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Octopus
Octopus Server
From 2022.2.6729 to 2022.2.7934
Octopus Server
From 2022.3.348 to 2022.3.9163

Related CWEs

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

References (2)

Source: security@octopus.com
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link

Timeline

No history available yet.