Server
by Octopus
Source repositories
CVEs (61)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-2416 | 0.00 | — | 0.00 | Aug 2, 2023 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment. | |||
| CVE-2022-2346 | 0.00 | — | 0.00 | Aug 2, 2023 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. | |||
| CVE-2022-4870 | 0.00 | — | 0.00 | May 18, 2023 | In affected versions of Octopus Deploy it is possible to discover network details via error message | |||
| CVE-2023-2247 | 0.00 | — | 0.00 | May 2, 2023 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function | |||
| CVE-2022-2507 | 0.00 | — | 0.01 | Apr 19, 2023 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage | |||
| CVE-2022-4009 | 0.00 | — | 0.01 | Mar 16, 2023 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation | |||
| CVE-2022-2258 | 0.00 | — | 0.00 | Mar 13, 2023 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items | |||
| CVE-2022-2259 | 0.00 | — | 0.00 | Mar 13, 2023 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items | |||
| CVE-2022-2883 | 0.00 | — | 0.01 | Feb 22, 2023 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | |||
| CVE-2022-4898 | 0.00 | — | 0.00 | Jan 31, 2023 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS | |||
| CVE-2022-3614 | 0.00 | — | 0.00 | Jan 3, 2023 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation. | |||
| CVE-2022-3460 | 0.00 | — | 0.00 | Jan 2, 2023 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. | |||
| CVE-2022-2721 | 0.00 | — | 0.00 | Nov 25, 2022 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled. | |||
| CVE-2022-2572 | 0.00 | — | 0.00 | Nov 1, 2022 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked. | |||
| CVE-2022-2508 | 0.00 | — | 0.00 | Oct 27, 2022 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging. | |||
| CVE-2022-2782 | 0.00 | — | 0.00 | Oct 26, 2022 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. | |||
| CVE-2022-2780 | 0.00 | — | 0.00 | Oct 14, 2022 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack. | |||
| CVE-2022-2828 | 0.00 | — | 0.00 | Oct 13, 2022 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability | |||
| CVE-2022-2720 | 0.00 | — | 0.00 | Oct 12, 2022 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work. | |||
| CVE-2022-2781 | 0.00 | — | 0.00 | Oct 6, 2022 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
- CVE-2022-2416Aug 2, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
- CVE-2022-2346Aug 2, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
- CVE-2022-4870May 18, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible to discover network details via error message
- CVE-2023-2247May 2, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
- CVE-2022-2507Apr 19, 2023risk 0.00cvss —epss 0.01
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
- CVE-2022-4009Mar 16, 2023risk 0.00cvss —epss 0.01
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
- CVE-2022-2258Mar 13, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items
- CVE-2022-2259Mar 13, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items
- CVE-2022-2883Feb 22, 2023risk 0.00cvss —epss 0.01
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
- CVE-2022-4898Jan 31, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
- CVE-2022-3614Jan 3, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.
- CVE-2022-3460Jan 2, 2023risk 0.00cvss —epss 0.00
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.
- CVE-2022-2721Nov 25, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
- CVE-2022-2572Nov 1, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
- CVE-2022-2508Oct 27, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.
- CVE-2022-2782Oct 26, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
- CVE-2022-2780Oct 14, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
- CVE-2022-2828Oct 13, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability
- CVE-2022-2720Oct 12, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work.
- CVE-2022-2781Oct 6, 2022risk 0.00cvss —epss 0.00
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
Page 2 of 4