Incorrect Expiration Time in OIDC Cookies Could Lead to Lifespan Exceedance
CVE-2024-7998

2.6LOW

Key Information:

Vendor: Octopus Deploy
Status: Octopus Server
Vendor: CVE Published:; 21 August 2024

🔔 Create Octopus Deploy Vulnerability Alert

What is CVE-2024-7998?

An issue has been identified in Octopus Server relating to OIDC cookies where the expiration time was incorrectly set. This misconfiguration allows OIDC cookies to utilize the maximum lifespan permitted, which could potentially enable unauthorized access or prolong session persistence beyond intended limits. Admins are advised to update to the latest version to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Octopus Server Windows 2022.4.8332 < 2024.1.12931

Octopus Server Windows 2024.1.437 < 2024.1.12931

Octopus Server Windows 2024.2.101 < 2024.2.9313

References

https://advisories.octopus.com/post/2024/sa2024-07/

CVSS V3.1

Score:

2.6

Severity:

LOW

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 21, 2024
Vulnerability Reserved
Aug 19, 2024

JSON

Octopus Deploy