CVE-2024-4456
published 2024-05-08CVE-2024-4456: In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.26%
16.7th percentile
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| octopus | octopus_server | >= 2024.1.437 < 2024.1.11127 | 2024.1.11127 |
| octopus | octopus_server | >= 3.0.0 < 2023.4.8338 | 2023.4.8338 |
| octopus_deploy | octopus_server | >= 2023.4.296 < 2023.4.8338 | 2023.4.8338 |
| octopus_deploy | octopus_server | >= 2024.1.437 < 2024.1.11127 | 2024.1.11127 |
| octopus_deploy | octopus_server | >= 3.0 < 2023.3.13361 | 2023.3.13361 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-08
Published