Read the docs
TI-2021-11815 Aliases CVE-2021-31818GHSA-6jqc-mwfj-6xjc

SQL injection in Octopus Server

Priority LOW 21CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.

Why it matters now

EPSS 0.00622 50th percentileScored 2026-11-07
Fix Fixed Octopus Server (Octopus Deploy): 2020.6.5146, 2021.1.7316

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Octopus DeployOctopus Server2018.9.17 and later; before 2020.6.5146; 2021.1.7149 and later; before 2021.1.73162020.6.5146, 2021.1.7316Patch availableCNA
  • Octopus Server VendorOctopus Deploy Affected 2018.9.17 and later; before 2020.6.5146; 2021.1.7149 and later; before 2021.1.7316 Fixed in 2020.6.5146, 2021.1.7316 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:*2018.9.17 to before 2018.13.0; 2020.0.0 to before 2020.6.0; 2020.6.0 to before 2020.6.5146; 2021.1.0 to before 2021.1.7316VulnerableOctopus Deploy
  • cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:* Versions 2018.9.17 to before 2018.13.0; 2020.0.0 to before 2020.6.0; 2020.6.0 to before 2020.6.5146; 2021.1.0 to before 2021.1.7316 Vulnerable ·Octopus Deploy

Remediation

  • Fix · CNA Octopus Server (Octopus Deploy) Fixed in 2020.6.5146, 2021.1.7316

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31818
  2. 2026-10-03 Alias added: GHSA-6jqc-mwfj-6xjc
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2021-11814 Cleartext storage of sensitive information in Octopus Server CVSS 3.1HIGH 7.5
  • TI-2021-11813 Cleartext storage of sensitive information in Octopus Server CVSS 3.1HIGH 7.5
  • TI-2021-10722 Cleartext storage of sensitive information in multiple versions of Octopus Server where… CVSS 3.1HIGH 7.5
  • TI-2019-11610 In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an… CVSS 3.0MEDIUM 6.5
  • TI-2019-11609 In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured… CVSS 3.0MEDIUM 6.5
  • TI-2019-13770 A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through… CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences