CVE-2022-2778: Critical severity octopus deploy vulnerability
Published Sep 30, 2022
·Updated
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
Affected Software
10 affected components
Octopus Octopus Server>=3.0<2022.2.8277
Octopus Octopus Server>=2022.3.348<2022.3.10405
Octopus Octopus Server>=2022.4.791<2022.4.1371
Linux Linux kernel
Microsoft Windows
All of the following
Any of the following
Octopus Octopus Server>=3.0<2022.2.8277
Octopus Octopus Server>=2022.3.348<2022.3.10405
Octopus Octopus Server>=2022.4.791<2022.4.1371
Any of the following
Linux Linux kernel
Microsoft Windows
Remediation
Patch Available
Event History
Sep 30, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2778?
CVE-2022-2778 has been classified with a severity level that allows for the bypass of rate limiting on login.
2
How do I fix CVE-2022-2778?
To fix CVE-2022-2778, it is recommended to update Octopus Deploy to the latest version that is not affected by this vulnerability.
3
Which versions of Octopus Deploy are affected by CVE-2022-2778?
CVE-2022-2778 affects Octopus Deploy versions between 3.0 and 2022.2.8277, 2022.3.348 and 2022.3.10405, and 2022.4.791 and 2022.4.1371.
4
What can an attacker do by exploiting CVE-2022-2778?
An attacker exploiting CVE-2022-2778 can bypass rate limiting, potentially leading to repeated login attempts without restriction.
5
Is the Linux Kernel vulnerable to CVE-2022-2778?
No, the Linux Kernel is not vulnerable to CVE-2022-2778.