Read the docs

Octopus Deploy

Records118All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high43CVSS 7.0–8.9

Exploited now

Octopus Deploy records in CISA KEV

No Octopus Deploy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Octopus Server 66 records MEDIUM Octopus Deploy 31 records MEDIUM Server 9 records LOW Tentacle 4 records LOW Codefresh 1 record MEDIUM Halibut 1 record MEDIUM Octopusdsc 1 record LOW

Records

4 records in Tentacle · all components

TI-2021-08281 CVE-2021-26557 · GHSA-jjvc-94pp-59jx

Untrusted search path in Octopus Tentacle

Priority LOW 34

When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00324 Published 2021-10-07 Fixed in 6.0.489 CWE-426
TI-2021-11819 CVE-2021-31822 · GHSA-gv66-6m64-mx48

Incorrect default permissions in Octopus Tentacle

Priority LOW 33

When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00215 Published 2021-11-24 Fixed in 6.1.1116 CWE-276
TI-2019-11610 CVE-2019-15508 · GHSA-5fjw-573q-gg89

In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an…

Priority LOW 30

In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request p…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00662 Published 2019-08-23 No fix listed CWE-312
TI-2021-11818 CVE-2021-31821 · GHSA-2986-5hcf-cm8g

Cleartext storage of sensitive information in Octopus Tentacle

Priority LOW 24

When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00185 Published 2022-01-19 Fixed in 6.1.1266 CWE-312
Open these records in search →