CVE-2022-2781: Medium severity octopus deploy vulnerability
Published Oct 6, 2022
·Updated
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
Affected Software
3 affected components
Octopus Octopus Server>=3.2.10<2022.1.3154
Octopus Octopus Server>=2022.2.6729<2022.2.7897
Octopus Octopus Server>=2022.3.348<2022.3.10586
Event History
Oct 6, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2781?
CVE-2022-2781 has a medium severity rating due to the potential for session hijacking.
2
How do I fix CVE-2022-2781?
To mitigate CVE-2022-2781, update Octopus Server to a version later than 2022.3.10586.
3
What versions of Octopus Server are affected by CVE-2022-2781?
CVE-2022-2781 affects Octopus Server versions between 3.2.10 and 2022.3.10586.
4
What risks are associated with CVE-2022-2781?
The risk associated with CVE-2022-2781 includes unauthorized access to sensitive session information.
5
Is encryption for session cookies secure in CVE-2022-2781?
In CVE-2022-2781, the same encryption process is used for both session cookies and variables, reducing security.