An issue was discovered in Octopus before 3.17.7.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• octopus octopus deployup to 3.17.6 inclusive

Other highest-scoring records for the same primary product.

• CVE-2020-10678In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user
  35Monitor
• CVE-2018-5706An issue was discovered in Octopus Deploy before 4.1.9.
  35Monitor
• CVE-2018-4862In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure accou
  35Monitor
• CVE-2017-17665In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments.
  35Monitor
• CVE-2019-11632In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEd
  32Monitor
• CVE-2021-26556When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user us
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.