CVE-2022-1670: High severity octopus deploy vulnerability
When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1670?
CVE-2022-1670 has been rated as a high severity vulnerability due to its potential for unauthorized user account creation.
How do I fix CVE-2022-1670?
To fix CVE-2022-1670, upgrade to a patched version of Octopus Server that is beyond the affected versions listed in the advisory.
What are the affected versions of Octopus Server for CVE-2022-1670?
CVE-2022-1670 affects Octopus Server versions prior to 2021.3.12533 and between 2022.1.0 and 2022.1.53.
What could happen if CVE-2022-1670 is exploited?
If exploited, CVE-2022-1670 could allow an attacker to create additional user accounts beyond the intended limit, potentially leading to unauthorized access.
Is there a workaround for CVE-2022-1670?
There is no known workaround for CVE-2022-1670, so updating to a secure version is the recommended mitigation.