{"id":"CVE-2021-31818","state":"PUBLISHED","title":"Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameteris","description":"Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.","publishedAt":"2021-06-17T13:22:17.000Z","updatedAt":"2024-08-03T23:10:30.820Z","severity":null,"assigner":"Octopus","products":["Octopus Deploy Octopus Server"],"affected":[{"vendor":"Octopus Deploy","product":"Octopus Server","versions":[{"version":"2018.9.17","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"2020.6.5146","versionType":"custom"},{"version":"2021.1.7149","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"2021.1.7316","versionType":"custom"}]}],"references":["https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29.2013233248.html"],"weaknesses":[],"ingestedAt":"2026-10-29T19:48:30.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/31xxx/CVE-2021-31818.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-31818","state":"PUBLISHED","datePublished":"2021-06-17T13:22:17.000Z","dateUpdated":"2024-08-03T23:10:30.820Z","assignerShortName":"Octopus","assignerOrgId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","dateReserved":"2021-04-26T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables."}],"affected":[{"vendor":"Octopus Deploy","product":"Octopus Server","versions":[{"version":"2018.9.17","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"2020.6.5146","versionType":"custom"},{"version":"2021.1.7149","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"2021.1.7316","versionType":"custom"}]}],"references":[{"url":"https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29.2013233248.html","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"SQL Injection","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"Octopus","dateUpdated":"2021-06-17T13:22:17.000Z","orgId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@octopus.com","ID":"CVE-2021-31818","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Octopus Server","version":{"version_data":[{"version_affected":">=","version_value":"2018.9.17"},{"version_affected":"<","version_value":"2020.6.5146"},{"version_affected":">=","version_value":"2021.1.7149"},{"version_affected":"<","version_value":"2021.1.7316"}]}}]},"vendor_name":"Octopus Deploy"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"SQL Injection"}]}]},"references":{"reference_data":[{"name":"https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-(CVE-2021-31818).2013233248.html","refsource":"MISC","url":"https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-(CVE-2021-31818).2013233248.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://advisories.octopus.com/adv/2021-04---SQL-Injection-in-the-Events-REST-API-%28CVE-2021-31818%29.2013233248.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T23:10:30.820Z"}}]}}}