CVE-2022-2828: Medium severity octopus deploy vulnerability

Q: What is CVE-2022-2828?

CVE-2022-2828 is an Insecure Direct Object Reference (IDOR) vulnerability in Octopus Server that allows the disclosure of information about teams via the API.

Q: How does CVE-2022-2828 affect Octopus Server?

CVE-2022-2828 affects Octopus Server by allowing an attacker to reveal information about teams through the API.

Q: What is the severity of CVE-2022-2828?

CVE-2022-2828 has a severity level of medium, with a CVSS score of 6.5.

Q: What versions of Octopus Server are affected by CVE-2022-2828?

Versions of Octopus Server from 2022.1.2121 to 2022.1.3135, 2022.2.0 to 2022.2.7897, and 2022.3.0 to 2022.3.10586 are affected by CVE-2022-2828.

Q: How can the CVE-2022-2828 vulnerability in Octopus Server be fixed?

To fix the CVE-2022-2828 vulnerability in Octopus Server, you should upgrade to a version beyond the affected range.

Published Oct 13, 2022

Updated

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Affected Software

3 affected components

Octopus Octopus Server>=2022.1.2121<=2022.1.3135

Octopus Octopus Server>=2022.2.0<=2022.2.7897

Octopus Octopus Server>=2022.3.0<=2022.3.10586

Event History

Oct 13, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2022-2828?

CVE-2022-2828 is an Insecure Direct Object Reference (IDOR) vulnerability in Octopus Server that allows the disclosure of information about teams via the API.

How does CVE-2022-2828 affect Octopus Server?

CVE-2022-2828 affects Octopus Server by allowing an attacker to reveal information about teams through the API.

What is the severity of CVE-2022-2828?