« Volver al listado

CVE-2019-19376

Estado: ModificadaMedia (6.5)—

In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Octopus — Octopus Deploy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-19376",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-28T17:15:12.777",
  "references": [
    {
      "url": "https://github.com/OctopusDeploy/Issues/issues/6005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/OctopusDeploy/Issues/issues/6005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)"
    },
    {
      "lang": "es",
      "value": "En Octopus Deploy versiones anteriores a la versión  2019.10.6, un usuario autenticado con permiso TeamEdit podría enviar una petición a la API Team malformada que omita la comprobación de entrada y cause una condición de denegación de servicio a nivel de la aplicación. (La corrección para esto también fue incluida en las versiones LTS 2019.9.8 y LTS 2019.6.14)."
    }
  ],
  "lastModified": "2026-06-17T02:26:35.343",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70EDE3D5-F20F-4921-8D92-A22ADB705325",
              "versionEndExcluding": "2019.10.7"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1DA09BB-D320-44FF-AF58-9A03EA5FD2BB",
              "versionEndExcluding": "2019.6.14",
              "versionStartIncluding": "2019.6.0"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75DEE42F-436E-4B39-B0D8-9F51A8FC82BA",
              "versionEndExcluding": "2019.9.8",
              "versionStartIncluding": "2019.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}