CVE-2017-16810

Cross-site scripting (XSS) vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 (fixed in 3.13.7) allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2017-11-14

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Octopus Deploy (Octopus)

References

• https://github.com/OctopusDeploy/Issues/issues/3919