| Package | Affected versions | Patched versions |
|---|---|---|
| octopus deploy | < 4.1.3 | 4.1.3 |
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free