« Back to list

CVE-2019-19376

Status: ModifiedMedium (6.5)—

In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Octopus — Octopus Deploy

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-19376",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-28T17:15:12.777",
  "references": [
    {
      "url": "https://github.com/OctopusDeploy/Issues/issues/6005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/OctopusDeploy/Issues/issues/6005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)"
    },
    {
      "lang": "es",
      "value": "En Octopus Deploy versiones anteriores a la versión  2019.10.6, un usuario autenticado con permiso TeamEdit podría enviar una petición a la API Team malformada que omita la comprobación de entrada y cause una condición de denegación de servicio a nivel de la aplicación. (La corrección para esto también fue incluida en las versiones LTS 2019.9.8 y LTS 2019.6.14)."
    }
  ],
  "lastModified": "2026-06-17T02:26:35.343",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70EDE3D5-F20F-4921-8D92-A22ADB705325",
              "versionEndExcluding": "2019.10.7"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1DA09BB-D320-44FF-AF58-9A03EA5FD2BB",
              "versionEndExcluding": "2019.6.14",
              "versionStartIncluding": "2019.6.0"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75DEE42F-436E-4B39-B0D8-9F51A8FC82BA",
              "versionEndExcluding": "2019.9.8",
              "versionStartIncluding": "2019.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}