CVE-2024-9194

SQL Injection in the Octopus Server REST API

State: Published
Severity: 8.7 High
Published: Sep 30, 2024
Updated: Nov 21, 2024
Reserved: Sep 25, 2024

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N	Octopus

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Octopus ServerLinux and Microsoft Windows	2024.1.0 to before 2024.1.13038Affected 2024.2.0 to before 2024.2.9482Affected 2024.3.0 to before 2024.3.12766Affected

References

https://advisories.octopus.com/post/2024/sa2024-09/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.