2 lines
4.0 KiB
JSON
2 lines
4.0 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2025.3.14761","status":"affected","version":"2023.0.0","versionType":"custom"},{"lessThan":"2025.4.10409","status":"affected","version":"2025.4.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*","matchCriteriaId":"8B609A0F-1C05-47BB-BA71-2A549AF037F8","versionEndExcluding":"2025.3.14761","versionStartIncluding":"2023.1.4189","vulnerable":true},{"criteria":"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*","matchCriteriaId":"6C328575-4BD6-4E45-B5D8-FBC4BCDD7E66","versionEndExcluding":"2025.4.10409","versionStartIncluding":"2025.4.51","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token."},{"lang":"es","value":"En las versiones afectadas de Octopus Server era posible crear una nueva clave de API a partir de un token de acceso existente, lo que resultaba en que la nueva clave de API tuviera una vida útil que excedía la clave de API original utilizada para generar el token de acceso."}],"id":"CVE-2026-3236","lastModified":"2026-06-17T10:43:15.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-05T14:16:57.713650Z","version":"2.0.3"}}]},"published":"2026-03-05T11:15:54.400","references":[{"source":"security@octopus.com","tags":["Vendor Advisory"],"url":"https://advisories.octopus.com/post/2026/sa2026-02"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]}
|