CVE-2020-16197

Katalog CVE

CVSS 4.3 · Medium EPSS 0,55%

Kerentanan Improper Certificate Validation pada octopus server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation.

Rincian

Terbit di NVD

25 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OctopusDeploy/Issues/issues/6529 advisory pihak ketiga
• https://github.com/OctopusDeploy/Issues/issues/6530 advisory pihak ketiga
• https://github.com/OctopusDeploy/Issues/issues/6531 advisory pihak ketiga