Local Privilege Escalation Flaw in Octopus Tentacle for Linux
CVE-2021-31822

7.8HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Tentacle
Vendor
CVE Published:
24 November 2021

What is CVE-2021-31822?

A misconfiguration in the systemd service file permissions of Octopus Tentacle installed on Linux systems allows local unprivileged users to modify the service file. This vulnerability can be exploited to gain elevated privileges, which may potentially lead to unauthorized access or manipulation of system resources.

Affected Version(s)

Octopus Tentacle 3.15.4

Octopus Tentacle < 6.1.1116

References

https://advisories.octopus.com/adv/2021-11---Local-privil...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.