2017-12-13 21:29:00 2019-10-03 02:03:26

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.

Vector

NETWORK

Complexity

LOW

Authentication

SINGLE_INSTANCE

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL
Octopus Octopus deploy 3.0.26 (not an official CPE) Octopus Octopus deploy 3.0.25 (not an official CPE) Octopus Octopus deploy 3.0.24 (not an official CPE) Octopus Octopus deploy 3.0.23 (not an official CPE) Octopus Octopus deploy 3.0.22 (not an official CPE) Octopus Octopus deploy 3.0.21 (not an official CPE) Octopus Octopus deploy 3.0.20 (not an official CPE) Octopus Octopus deploy 3.0.19 (not an official CPE) Octopus Octopus deploy 3.0.18 (not an official CPE) Octopus Octopus deploy 3.0.17 (not an official CPE) Octopus Octopus deploy 3.0.16 (not an official CPE) Octopus Octopus deploy 3.0.15 (not an official CPE) Octopus Octopus deploy 3.0.14 (not an official CPE) Octopus Octopus deploy 3.0.13 (not an official CPE) Octopus Octopus deploy 3.0.12 (not an official CPE) Octopus Octopus deploy 3.0.11 (not an official CPE) Octopus Octopus deploy 3.0.10 (not an official CPE) Octopus Octopus deploy 3.0.9 (not an official CPE) Octopus Octopus deploy 3.0.8 (not an official CPE) Octopus Octopus deploy 3.0.7 (not an official CPE) Octopus Octopus deploy 3.0.6 (not an official CPE) Octopus Octopus deploy 3.0.5 (not an official CPE) Octopus Octopus deploy 3.0.4 (not an official CPE) Octopus Octopus deploy 3.0.3 (not an official CPE) Octopus Octopus deploy 3.0.2 (not an official CPE) Octopus Octopus deploy 3.0.1 (not an official CPE) Octopus Octopus deploy 3.0.0 (not an official CPE) Octopus Octopus deploy 3.0 (not an official CPE) Octopus Octopus deploy 2.6.5 (not an official CPE) Octopus Octopus deploy 2.6.4 (not an official CPE) Octopus Octopus deploy 2.6.3 (not an official CPE) Octopus Octopus deploy 2.6.2 (not an official CPE) Octopus Octopus deploy 2.6.1 (not an official CPE) Octopus Octopus deploy 2.6.0 (not an official CPE) Octopus Octopus deploy 2.6 (not an official CPE) Octopus Octopus deploy 2.5.13 (not an official CPE) Octopus Octopus deploy 2.5.12 (not an official CPE) Octopus Octopus deploy 2.5.11 (not an official CPE) Octopus Octopus deploy 2.5.10 (not an official CPE) Octopus Octopus deploy 2.5.9 (not an official CPE) Octopus Octopus deploy 2.5.8 (not an official CPE) Octopus Octopus deploy 2.5.7 (not an official CPE) Octopus Octopus deploy 2.5.6 (not an official CPE) Octopus Octopus deploy 2.5.5 (not an official CPE) Octopus Octopus deploy 2.5.4 (not an official CPE) Octopus Octopus deploy 2.5 (not an official CPE) Octopus Octopus deploy 2.4.10 (not an official CPE) Octopus Octopus deploy 2.4.9 (not an official CPE) Octopus Octopus deploy 2.4.8 (not an official CPE) Octopus Octopus deploy 2.4.7 (not an official CPE) Octopus Octopus deploy 2.4.5 (not an official CPE) Octopus Octopus deploy 2.4 (not an official CPE) Octopus Octopus deploy 2.3.6 (not an official CPE) Octopus Octopus deploy 2.3.3 (not an official CPE) Octopus Octopus deploy 2.3 (not an official CPE) Octopus Octopus deploy 2.2 (not an official CPE) Octopus Octopus deploy 2.1 (not an official CPE) Octopus Octopus deploy 2.0.13.1100 (not an official CPE) Octopus Octopus deploy 2.0.12.1092 (not an official CPE) Octopus Octopus deploy 2.0.11.1080 (not an official CPE) Octopus Octopus deploy 2.0.10.1066 (not an official CPE) Octopus Octopus deploy 2.0.10.1059 (not an official CPE) Octopus Octopus deploy 2.0.9.1020 (not an official CPE) Octopus Octopus deploy 2.0.9.1015 (not an official CPE) Octopus Octopus deploy 2.0.8.977 (not an official CPE) Octopus Octopus deploy 2.0.7.966 (not an official CPE) Octopus Octopus deploy 2.0.6.950 (not an official CPE) Octopus Octopus deploy 2.0.5.933 (not an official CPE) Octopus Octopus deploy 2.0 (not an official CPE) Octopus Octopus deploy 1.6.3.1723 (not an official CPE) Octopus Octopus deploy 1.6.2.1722 (not an official CPE) Octopus Octopus deploy 1.6.1.1718 (not an official CPE) Octopus Octopus deploy 1.6.0.1714 (not an official CPE) Octopus Octopus deploy 1.6.0.1712 (not an official CPE) Octopus Octopus deploy 1.6 (not an official CPE) Octopus Octopus deploy 1.5.1.1652 (not an official CPE) Octopus Octopus deploy 1.5.0.1647 (not an official CPE) Octopus Octopus deploy 1.5.0.1645 (not an official CPE) Octopus Octopus deploy 1.5 (not an official CPE) Octopus Octopus deploy 1.4.0.1592 (not an official CPE) Octopus Octopus deploy 1.4.0.1589 (not an official CPE) Octopus Octopus deploy 1.4 (not an official CPE) Octopus Octopus deploy 1.3.5.1564 (not an official CPE) Octopus Octopus deploy 1.3.0.1535 (not an official CPE) Octopus Octopus deploy 1.3 (not an official CPE) Octopus Octopus deploy 1.2.3.1515 (not an official CPE) Octopus Octopus deploy 1.2.3.1476 (not an official CPE) Octopus Octopus deploy 1.2.2.1455 (not an official CPE) Octopus Octopus deploy 1.2.1.1447 (not an official CPE) Octopus Octopus deploy 1.2.0.1445 (not an official CPE) Octopus Octopus deploy 1.2 (not an official CPE) Octopus Octopus deploy 1.1.8.1431 (not an official CPE) Octopus Octopus deploy 1.1.8.1430 (not an official CPE) Octopus Octopus deploy 1.1.7.1426 (not an official CPE) Octopus Octopus deploy 1.1.6.1424 (not an official CPE) Octopus Octopus deploy 1.1.5.1422 (not an official CPE) Octopus Octopus deploy 1.1.3.1410 (not an official CPE) Octopus Octopus deploy 1.1.1.1404 (not an official CPE) Octopus Octopus deploy 1.1.1.1394 (not an official CPE) Octopus Octopus deploy 1.1 (not an official CPE) Octopus Octopus deploy 1.0.31.1366 (not an official CPE) Octopus Octopus deploy 1.0.30.1340 (not an official CPE) Octopus Octopus deploy 1.0.29.1338 (not an official CPE) Octopus Octopus deploy 1.0.28.1336 (not an official CPE) Octopus Octopus deploy 1.0.26.1320 (not an official CPE) Octopus Octopus deploy 1.0.25.1318 (not an official CPE) Octopus Octopus deploy 1.0.24.1316 (not an official CPE) Octopus Octopus deploy 1.0.23.1315 (not an official CPE) Octopus Octopus deploy 1.0.22.1312 (not an official CPE) Octopus Octopus deploy 1.0.20.1303 (not an official CPE) Octopus Octopus deploy 1.0.19.1298 (not an official CPE) Octopus Octopus deploy 1.0.19.1297 (not an official CPE) Octopus Octopus deploy 1.0.18.1294 (not an official CPE) Octopus Octopus deploy 1.0.17.1287 (not an official CPE) Octopus Octopus deploy 1.0.16.1276 (not an official CPE) Octopus Octopus deploy 1.0.15.1251 (not an official CPE) Octopus Octopus deploy 1.0.15.1250 (not an official CPE) Octopus Octopus deploy 1.0.15.1249 (not an official CPE) Octopus Octopus deploy 1.0.15.1246 (not an official CPE) Octopus Octopus deploy 1.0.15.1241 (not an official CPE) Octopus Octopus deploy 1.0.15.1228 (not an official CPE) Octopus Octopus deploy 1.0.14.1212 (not an official CPE) Octopus Octopus deploy 1.0.13.1209 (not an official CPE) Octopus Octopus deploy 1.0.13.1206 (not an official CPE) Octopus Octopus deploy 1.0.13.1204 (not an official CPE) Octopus Octopus deploy 1.0.13.1202 (not an official CPE) Octopus Octopus deploy 1.0.13.1201 (not an official CPE) Octopus Octopus deploy 1.0.13.13 (not an official CPE) Octopus Octopus deploy 1.0 (not an official CPE) Octopus Octopus deploy 0.9.620.4 (not an official CPE) Octopus Octopus deploy 0.9.620.3 (not an official CPE) Octopus Octopus deploy 0.9.620.2 (not an official CPE) Octopus Octopus deploy 0.9.600.163 (not an official CPE) Octopus Octopus deploy 0.9.600.162 (not an official CPE) Octopus Octopus deploy 0.9.574.2644 (not an official CPE) Octopus Octopus deploy 0.9.571.2641 (not an official CPE) Octopus Octopus deploy 0.9.568.2630 (not an official CPE) Octopus Octopus deploy 0.9.511.2528 (not an official CPE) Octopus Octopus deploy 0.9 (not an official CPE) Octopus Octopus deploy 3.1 (not an official CPE) Octopus Octopus deploy 3.1.0 (not an official CPE) Octopus Octopus deploy 3.1.0 Beta0001 (not an official CPE) Octopus Octopus deploy 3.1.0 Beta0002 (not an official CPE) Octopus Octopus deploy 3.1.1 (not an official CPE) Octopus Octopus deploy 3.1.2 (not an official CPE) Octopus Octopus deploy 3.1.3 (not an official CPE) Octopus Octopus deploy 3.1.4 (not an official CPE) Octopus Octopus deploy 3.1.5 (not an official CPE) Octopus Octopus deploy 3.1.6 (not an official CPE) Octopus Octopus deploy 3.1.7 (not an official CPE) Octopus Octopus deploy 3.1.12 (not an official CPE) Octopus Octopus deploy 3.1.13 (not an official CPE) Octopus Octopus deploy 3.2 (not an official CPE) Octopus Octopus deploy 3.2.0 (not an official CPE) Octopus Octopus deploy 3.2.0 Beta0001 (not an official CPE) Octopus Octopus deploy 3.2.1 (not an official CPE) Octopus Octopus deploy 3.2.2 (not an official CPE) Octopus Octopus deploy 3.2.3 (not an official CPE) Octopus Octopus deploy 3.2.4 (not an official CPE) Octopus Octopus deploy 3.2.6 (not an official CPE) Octopus Octopus deploy 3.2.7 (not an official CPE) Octopus Octopus deploy 3.2.8 (not an official CPE) Octopus Octopus deploy 3.2.9 (not an official CPE) Octopus Octopus deploy 3.2.10 (not an official CPE) Octopus Octopus deploy 3.2.11 (not an official CPE) Octopus Octopus deploy 3.2.12 (not an official CPE) Octopus Octopus deploy 3.2.13 (not an official CPE) Octopus Octopus deploy 3.2.15 (not an official CPE) Octopus Octopus deploy 3.2.16 (not an official CPE) Octopus Octopus deploy 3.2.17 (not an official CPE) Octopus Octopus deploy 3.2.19 (not an official CPE) Octopus Octopus deploy 3.2.20 (not an official CPE) Octopus Octopus deploy 3.2.21 (not an official CPE) Octopus Octopus deploy 3.2.22 (not an official CPE) Octopus Octopus deploy 3.2.23 (not an official CPE) Octopus Octopus deploy 3.2.24 (not an official CPE) Octopus Octopus deploy 3.3 (not an official CPE) Octopus Octopus deploy 3.3.0 (not an official CPE) Octopus Octopus deploy 3.3.0 Beta0001 (not an official CPE) Octopus Octopus deploy 3.3.0 Beta0002 (not an official CPE) Octopus Octopus deploy 3.3.1 (not an official CPE) Octopus Octopus deploy 3.3.2 (not an official CPE) Octopus Octopus deploy 3.3.3 (not an official CPE) Octopus Octopus deploy 3.3.4 (not an official CPE) Octopus Octopus deploy 3.3.5 (not an official CPE) Octopus Octopus deploy 3.3.6 (not an official CPE) Octopus Octopus deploy 3.3.8 (not an official CPE) Octopus Octopus deploy 3.3.9 (not an official CPE) Octopus Octopus deploy 3.3.10 (not an official CPE) Octopus Octopus deploy 3.3.11 (not an official CPE) Octopus Octopus deploy 3.3.12 (not an official CPE) Octopus Octopus deploy 3.3.14 (not an official CPE) Octopus Octopus deploy 3.3.15 (not an official CPE) Octopus Octopus deploy 3.3.16 (not an official CPE) Octopus Octopus deploy 3.3.17 (not an official CPE) Octopus Octopus deploy 3.3.18 (not an official CPE) Octopus Octopus deploy 3.3.19 (not an official CPE) Octopus Octopus deploy 3.3.20 (not an official CPE) Octopus Octopus deploy 3.3.21 (not an official CPE) Octopus Octopus deploy 3.3.22 (not an official CPE) Octopus Octopus deploy 3.3.23 (not an official CPE) Octopus Octopus deploy 3.3.24 (not an official CPE) Octopus Octopus deploy 3.3.25 (not an official CPE) Octopus Octopus deploy 3.3.26 (not an official CPE) Octopus Octopus deploy 3.3.27 (not an official CPE) Octopus Octopus deploy 3.4 (not an official CPE) Octopus Octopus deploy 3.4.0 (not an official CPE) Octopus Octopus deploy 3.4.0 Beta0001 (not an official CPE) Octopus Octopus deploy 3.4.0 Beta0002 (not an official CPE) Octopus Octopus deploy 3.4.1 (not an official CPE) Octopus Octopus deploy 3.4.3 (not an official CPE) Octopus Octopus deploy 3.4.4 (not an official CPE) Octopus Octopus deploy 3.4.5 (not an official CPE) Octopus Octopus deploy 3.4.6 (not an official CPE) Octopus Octopus deploy 3.4.7 (not an official CPE) Octopus Octopus deploy 3.4.8 (not an official CPE) Octopus Octopus deploy 3.4.9 (not an official CPE) Octopus Octopus deploy 3.4.10 (not an official CPE) Octopus Octopus deploy 3.4.11 (not an official CPE) Octopus Octopus deploy 3.4.12 (not an official CPE) Octopus Octopus deploy 3.4.13 (not an official CPE) Octopus Octopus deploy 3.4.14 (not an official CPE) Octopus Octopus deploy 3.4.15 (not an official CPE) Octopus Octopus deploy 3.5 (not an official CPE) Octopus Octopus deploy 3.5.1 (not an official CPE) Octopus Octopus deploy 3.5.2 (not an official CPE) Octopus Octopus deploy 3.5.4 (not an official CPE) Octopus Octopus deploy 3.5.5 (not an official CPE) Octopus Octopus deploy 3.5.6 (not an official CPE) Octopus Octopus deploy 3.5.7 (not an official CPE) Octopus Octopus deploy 3.5.8 (not an official CPE) Octopus Octopus deploy 3.5.9 (not an official CPE) Octopus Octopus deploy 3.6 (not an official CPE) Octopus Octopus deploy 3.6.0 (not an official CPE) Octopus Octopus deploy 3.6.1 (not an official CPE) Octopus Octopus deploy 3.6.2 (not an official CPE) Octopus Octopus deploy 3.7 (not an official CPE) Octopus Octopus deploy 3.7.0 (not an official CPE) Octopus Octopus deploy 3.7.1 (not an official CPE) Octopus Octopus deploy 3.7.2 (not an official CPE) Octopus Octopus deploy 3.7.3 (not an official CPE) Octopus Octopus deploy 3.7.4 (not an official CPE) Octopus Octopus deploy 3.7.5 (not an official CPE) Octopus Octopus deploy 3.7.6 (not an official CPE) Octopus Octopus deploy 3.7.7 (not an official CPE) Octopus Octopus deploy 3.7.8 (not an official CPE) Octopus Octopus deploy 3.7.9 (not an official CPE) Octopus Octopus deploy 3.7.10 (not an official CPE) Octopus Octopus deploy 3.7.11 (not an official CPE) Octopus Octopus deploy 3.7.12 (not an official CPE) Octopus Octopus deploy 3.7.13 (not an official CPE) Octopus Octopus deploy 3.7.14 (not an official CPE) Octopus Octopus deploy 3.7.15 (not an official CPE) Octopus Octopus deploy 3.7.16 (not an official CPE) Octopus Octopus deploy 3.7.17 (not an official CPE) Octopus Octopus deploy 3.7.18 (not an official CPE) Octopus Octopus deploy 3.8 (not an official CPE) Octopus Octopus deploy 3.8.0 (not an official CPE) Octopus Octopus deploy 3.8.1 (not an official CPE) Octopus Octopus deploy 3.8.2 (not an official CPE) Octopus Octopus deploy 3.8.3 (not an official CPE) Octopus Octopus deploy 3.8.4 (not an official CPE) Octopus Octopus deploy 3.8.5 (not an official CPE) Octopus Octopus deploy 3.8.6 (not an official CPE) Octopus Octopus deploy 3.8.7 (not an official CPE) Octopus Octopus deploy 3.8.8 (not an official CPE) Octopus Octopus deploy 3.8.9 (not an official CPE) Octopus Octopus deploy 3.9 (not an official CPE) Octopus Octopus deploy 3.9.0 (not an official CPE) Octopus Octopus deploy 3.10.0 (not an official CPE) Octopus Octopus deploy 3.10.1 (not an official CPE) Octopus Octopus deploy 3.11 (not an official CPE) Octopus Octopus deploy 3.11.0 (not an official CPE) Octopus Octopus deploy 3.11.1 (not an official CPE) Octopus Octopus deploy 3.11.2 (not an official CPE) Octopus Octopus deploy 3.11.3 (not an official CPE) Octopus Octopus deploy 3.11.4 (not an official CPE) Octopus Octopus deploy 3.11.5 (not an official CPE) Octopus Octopus deploy 3.11.6 (not an official CPE) Octopus Octopus deploy 3.11.7 (not an official CPE) Octopus Octopus deploy 3.11.9 (not an official CPE) Octopus Octopus deploy 3.11.10 (not an official CPE) Octopus Octopus deploy 3.11.11 (not an official CPE) Octopus Octopus deploy 3.11.12 (not an official CPE) Octopus Octopus deploy 3.11.13 (not an official CPE) Octopus Octopus deploy 3.11.14 (not an official CPE) Octopus Octopus deploy 3.11.15 (not an official CPE) Octopus Octopus deploy 3.11.16 (not an official CPE) Octopus Octopus deploy 3.11.17 (not an official CPE) Octopus Octopus deploy 3.11.18 (not an official CPE) Octopus Octopus deploy 3.12 (not an official CPE) Octopus Octopus deploy 3.12.0 (not an official CPE) Octopus Octopus deploy 3.12.1 (not an official CPE) Octopus Octopus deploy 3.12.2 (not an official CPE) Octopus Octopus deploy 3.12.3 (not an official CPE) Octopus Octopus deploy 3.12.4 (not an official CPE) Octopus Octopus deploy 3.12.5 (not an official CPE) Octopus Octopus deploy 3.12.6 (not an official CPE) Octopus Octopus deploy 3.12.7 (not an official CPE) Octopus Octopus deploy 3.12.8 (not an official CPE) Octopus Octopus deploy 3.12.9 (not an official CPE) Octopus Octopus deploy 3.13 (not an official CPE) Octopus Octopus deploy 3.13.0 (not an official CPE) Octopus Octopus deploy 3.13.1 (not an official CPE) Octopus Octopus deploy 3.13.2 (not an official CPE) Octopus Octopus deploy 3.13.3 (not an official CPE) Octopus Octopus deploy 3.13.5 (not an official CPE) Octopus Octopus deploy 3.13.6 (not an official CPE) Octopus Octopus deploy 3.13.7 (not an official CPE) Octopus Octopus deploy 3.13.8 (not an official CPE) Octopus Octopus deploy 3.13.9 (not an official CPE) Octopus Octopus deploy 3.13.10 (not an official CPE) Octopus Octopus deploy 3.14 (not an official CPE) Octopus Octopus deploy 3.14.1 (not an official CPE) Octopus Octopus deploy 3.14.15 (not an official CPE) Octopus Octopus deploy 3.14.159 (not an official CPE) Octopus Octopus deploy 3.14.1592 (not an official CPE) Octopus Octopus deploy 3.14.15926 (not an official CPE) Octopus Octopus deploy 3.15 (not an official CPE) Octopus Octopus deploy 3.15.0 (not an official CPE) Octopus Octopus deploy 3.15.1 (not an official CPE) Octopus Octopus deploy 3.15.2 (not an official CPE) Octopus Octopus deploy 3.15.3 (not an official CPE) Octopus Octopus deploy 3.15.4 (not an official CPE) Octopus Octopus deploy 3.15.5 (not an official CPE) Octopus Octopus deploy 3.15.6 (not an official CPE) Octopus Octopus deploy 3.15.7 (not an official CPE) Octopus Octopus deploy 3.15.8 (not an official CPE) Octopus Octopus deploy 3.16 (not an official CPE) Octopus Octopus deploy 3.16.0 (not an official CPE) Octopus Octopus deploy 3.16.1 (not an official CPE) Octopus Octopus deploy 3.16.2 (not an official CPE) Octopus Octopus deploy 3.16.3 (not an official CPE) Octopus Octopus deploy 3.16.4 (not an official CPE) Octopus Octopus deploy 3.16.5 (not an official CPE) Octopus Octopus deploy 3.16.6 (not an official CPE) Octopus Octopus deploy 3.16.7 (not an official CPE) Octopus Octopus deploy 3.17 (not an official CPE) Octopus Octopus deploy 3.17.0 (not an official CPE) Octopus Octopus deploy 3.17.1 (not an official CPE) Octopus Octopus deploy 3.17.2 (not an official CPE) Octopus Octopus deploy 3.17.3 (not an official CPE) Octopus Octopus deploy 3.17.4 (not an official CPE) Octopus Octopus deploy 3.17.5 (not an official CPE) Octopus Octopus deploy 3.17.6 (not an official CPE) Octopus Octopus deploy 3.17.7 (not an official CPE) Octopus Octopus deploy 3.17.8 (not an official CPE) Octopus Octopus deploy 3.17.9 (not an official CPE) Octopus Octopus deploy 3.17.10 (not an official CPE) Octopus Octopus deploy 3.17.11 (not an official CPE) Octopus Octopus deploy 3.17.12 (not an official CPE) Octopus Octopus deploy 3.17.13 (not an official CPE) Octopus Octopus deploy 3.17.14 (not an official CPE) Octopus Octopus deploy 4.0.0 Rc (not an official CPE) Octopus Octopus deploy 4.0.1 Rc (not an official CPE) Octopus Octopus deploy 4.0.2 Rc (not an official CPE) Octopus Octopus deploy 4.0.3 Rc (not an official CPE) Octopus Octopus deploy 4.0.4 (not an official CPE) Octopus Octopus deploy 4.0.5 (not an official CPE) Octopus Octopus deploy 4.0.6 (not an official CPE) Octopus Octopus deploy 4.0.7 (not an official CPE) Octopus Octopus deploy 4.0.8 (not an official CPE) Octopus Octopus deploy 4.0.9 (not an official CPE) Octopus Octopus deploy 4.0.10 (not an official CPE) Octopus Octopus deploy 4.0.11 (not an official CPE) Octopus Octopus deploy 4.1.0 (not an official CPE) Octopus Octopus deploy 4.1.1 (not an official CPE) Octopus Octopus deploy 4.1.2 (not an official CPE)