What is CVE-2019-19376?

CVE-2019-19376 is a medium-severity vulnerability in Octopus Deploy, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2019-11-28.

How severe is CVE-2019-19376?

Medium severity. CVSS v3 base score is 6.5 out of 10.

NULL pointer dereference in Octopus Deploy

CVE-2019-19376

In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.010 (58.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Octopus Octopus_deploy
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-19376?: CVE-2019-19376 is a medium-severity vulnerability in Octopus Deploy, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2019-11-28.
How severe is CVE-2019-19376?: Medium severity. CVSS v3 base score is 6.5 out of 10.