Vulnerability DatabaseCVE-2024-2975

CVE-2024-2975:
Octopus Deploy vulnerability analysis and mitigation

Overview

CVE-2024-2975 is a critical vulnerability discovered in Octopus Deploy, a deployment automation platform. The vulnerability was identified on February 20, 2024, and patched on March 21, 2024. It affects multiple versions of Octopus Server, including all versions prior to 2023.4.8432, all 2023.x.x versions, 2024.1.x versions prior to 2024.1.12087, and 2024.2.x versions prior to 2024.2.2075 (Octopus Advisory).

Technical details

The vulnerability is characterized by a race condition within the Octopus Server that could lead to privilege escalation under certain configurations. It has been assigned a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-1223 (Race Condition for Write-Once Attributes) (NVD).

Impact

Successful exploitation of this vulnerability could allow unprivileged users to elevate their access within the software, potentially enabling them to execute privileged actions and gain unauthorized access to sensitive information (Security Online).

Mitigation and workarounds

Octopus Deploy strongly recommends upgrading to version 2024.1.12087 or later to address this vulnerability. For users unable to upgrade to the latest version, specific version upgrades are provided based on the current version in use. There are no known mitigations for this vulnerability other than upgrading to a patched version (Octopus Advisory).