CVE-2017-15610

6.5 mediumEPSS 0.6%

Medium (6.5) in octopus octopus deploy. EPSS 0.6% chance of exploitation in the next 30 days.

An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2017-10-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

octopus:octopus_deploy

References

https://github.com/OctopusDeploy/Issues/issues/3869
https://github.com/OctopusDeploy/Issues/issues/3869

Check your stack JSON