CVE-2018-10581
published 2018-05-01CVE-2018-10581: In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments…
PriorityP425medium5.4CVSS 3.0
AVNACLPRLUINSUCLILAN
EPSS
0.74%
50.0th percentile
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| appgyver | steroids | 0 – 4.1.27 | — |
| octopus | octopus_deploy | >= 3.4.0 < 2018.4.7 | 2018.4.7 |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-phvv-m9jq-97vr: In Octopus Deploy 3
ghsa_unreviewed·2022-05-14
CVE-2018-10581 [MEDIUM] CWE-200 GHSA-phvv-m9jq-97vr: In Octopus Deploy 3
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
GHSA
steroids downloads resources over HTTP
ghsa·2019-02-18
CVE-2016-10581 [HIGH] CWE-311 steroids downloads resources over HTTP
steroids downloads resources over HTTP
Affected versions of `steroids` insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `steroids`.
## Recommendation
This vulnerability was discovered and reported in 2016, yet has not seen a patch issued as of 03/2018. As of 08/2022, [the package is marked as deprecated](https://www.npmjs.com/package/steroids) and the GitHub repository is no longer publicly available.
The best path forward for mitigating this issue is to attempt to use an alternative module that is actively maintained and which provides similar functionality,
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-05-01
Published