CVE-2022-2528: Medium severity octopus deploy vulnerability

Q: What is the severity of CVE-2022-2528?

CVE-2022-2528 has been classified with a medium severity level due to the potential for unauthorized package uploads.

Q: How do I fix CVE-2022-2528?

To fix CVE-2022-2528, upgrade your Octopus Deploy server to a version that is not affected by this vulnerability.

Q: What are the affected versions for CVE-2022-2528?

CVE-2022-2528 affects Octopus Deploy versions between 3.0.0 and 4.1.10, as well as various other versions within the specified ranges.

Q: What impact does CVE-2022-2528 have on Octopus Deploy?

CVE-2022-2528 allows unauthorized users to upload packages to the built-in feed, potentially compromising application security.

Q: Is CVE-2022-2528 a common vulnerability in Octopus Deploy?

While not widespread, CVE-2022-2528 is significant for users of affected Octopus Deploy versions due to its implications for access control.

Published Sep 9, 2022

Updated

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.

Affected Software

5 affected components

Octopus Octopus Server>=3.0.0<=4.1.10

Octopus Octopus Server>=2018.1.0<=2021.3.13021

Octopus Octopus Server>=2022.1.0<2022.1.3106

Octopus Octopus Server>=2022.2.6729<2022.2.7718

Octopus Octopus Server>=2022.3.348<2022.3.7782

Event History

Sep 9, 2022

CVE Published

via MITRE·07:50 AM

Data Sourced

via MITRE·07:50 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-2528?

CVE-2022-2528 has been classified with a medium severity level due to the potential for unauthorized package uploads.

How do I fix CVE-2022-2528?

To fix CVE-2022-2528, upgrade your Octopus Deploy server to a version that is not affected by this vulnerability.

What are the affected versions for CVE-2022-2528?