CVE-2018-18850

 

Published at: - 31-10-2018 04:29

Last modified: - 27-07-2022 06:40

Total changes: - 2

Description

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server (for self-hosted installations by default, SYSTEM).

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/OctopusDeploy/Issues/issues/5042

 

Keywords

NVD

 

CVE-2018-18850

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures