CVE-2024-9194 — SQL Injection in the Octopus Server REST API

CVE-2024-9194

SQL Injection in the Octopus Server REST API PUBLISHED

Description (CNA)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766.

Affected (CNA)

Vendor / product	Versions
Linux and Microsoft Windows / Octopus Server	affected 2024.1.0 before 2024.1.13038; affected 2024.2.0 before 2024.2.9482; affected 2024.3.0 before 2024.3.12766

CWE

CWE-89

References

https://advisories.octopus.com/post/2024/sa2024-09/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.