| Package | Affected versions | Patched versions |
|---|---|---|
| server | ≥ 2018.9.17, < 2018.13.0≥ 2020.0.0, < 2020.6.0≥ 2020.6.0, < 2020.6.5146≥ 2021.1.0, < 2021.1.7316 | 2018.13.02020.6.02020.6.51462021.1.7316 |
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free