Local Privilege Escalation Vulnerability in Octopus Server by Octopus Deploy
CVE-2021-26556

7.8HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
7 October 2021

What is CVE-2021-26556?

A local privilege escalation vulnerability exists in Octopus Server when it is installed in a custom folder location. This flaw arises due to incorrect folder ACLs, which may allow an unprivileged user to exploit DLL side-loading techniques to gain elevated privileges. Organizations utilizing custom installations of Octopus Server should review their configurations and apply mitigations to ensure they are not susceptible to this security issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Octopus Server 0.9

Octopus Server < 2020.4.229

Octopus Server 2020.5.0

References

https://advisories.octopus.com/adv/2021-01---Local-privil...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.