Vulnerabilidades em Octopus Deploy

80 resultados
Análise Vexday

Com 66 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Octopus Deploy apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere um perfil de risco operacional relativamente controlado no momento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora amplamente conhecido, exige atenção contínua em ferramentas de orquestração de deploys pela exposição a interfaces web. A CVE mais perigosa identificada atualmente é CVE-2021-31819, com score EPSS de 0,0228, indicando baixa probabilidade de exploração ativa iminente, mas ainda relevante para priorização em ambientes que não realizaram a correção. As 3 vulnerabilidades críticas catalogadas e as 2 CVEs surgidas nos últimos 90 dias reforçam a necessidade de manter o ciclo de patching atualizado, especialmente em pipelines de entrega contínua onde o impacto de uma comprometimento pode se propagar rapidamente por ambientes downstream.

CVE-2022-4898MEDIUMIn affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. ThiEPSS 0.4%CVE-2023-1904MEDIUMIn affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of OcEPSS 0.4%CVE-2026-14163HIGHIn affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment vaEPSS 0.4%CVE-2026-0704MEDIUMIn affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field EPSS 0.4%CVE-2025-0525LOWIn affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could EPSS 0.4%CVE-2025-0589MEDIUMIn affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated EPSS 0.4%CVE-2025-0539MEDIUMIn affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authenticEPSS 0.4%CVE-2024-12226MEDIUMIn affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cleEPSS 0.4%CVE-2025-0526LOWIn affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field EPSS 0.4%CVE-2026-101169HIGHIn affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafteEPSS 0.3%CVE-2022-2346MEDIUMIn affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.EPSS 0.3%CVE-2026-12702MEDIUMIn affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymenEPSS 0.3%CVE-2021-26557—When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user EPSS 0.3%CVE-2026-8296MEDIUMIn affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.EPSS 0.3%CVE-2026-12887MEDIUMIn affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the scEPSS 0.3%CVE-2024-4226LOWIt was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and pEPSS 0.3%CVE-2022-2416MEDIUMIn affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of anEPSS 0.3%CVE-2026-102478HIGHIn affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing accessEPSS 0.3%CVE-2026-118426MEDIUMIn affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user searchEPSS 0.3%CVE-2021-26556—When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user usEPSS 0.3%