CVE-2022-4898: XSS
First published: Tue Jan 31 2023(Updated: )
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
Credit: security@octopus.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Octopus Octopus Server | >=2019.7.0<2022.2.8552 | |
| Octopus Octopus Server | >=2022.3.348<2022.3.10750 | |
| Octopus Octopus Server | >=2022.4.791<2022.4.8319 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-4898 vulnerability?
CVE-2022-4898 vulnerability allows customization of the help sidebar in Octopus Server to include a Cross-Site Scripting payload in the support link, affecting certain versions of the software.
How to mitigate CVE-2022-4898?
To mitigate CVE-2022-4898, it is recommended to update Octopus Server to a non-vulnerable version as provided in the advisory.
What is the severity of CVE-2022-4898?
The severity of CVE-2022-4898 is rated as medium with a CVSS score of 5.4.
- collector/nvd-index
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/type
- agent/references
- agent/event
- agent/author
- agent/tags
- agent/weakness
- collector/mitre-cve
- source/MITRE
- vendor/octopus
- canonical/octopus octopus server
- version/octopus octopus server/2019.7.0
- version/octopus octopus server/2022.3.348
- version/octopus octopus server/2022.4.791