CVE-2022-1881

Published: Jul 15, 2022Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.

Affected (4)

Products: Octopus: Octopus Server

Octopus

1 product

Octopus Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Octopus Octopus Server	From 2021.1.6959 to 2021.3.13021
Octopus Octopus Server	From 2022.1.2121 to 2022.1.2894
Octopus Octopus Server	From 2022.2.6729 to 2022.2.6971
Octopus Octopus Server	From 2022.3.348 to 2022.3.2616

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://advisories.octopus.com/post/2022/sa2022-06/

Source: security@octopus.com

Vendor Advisory

https://advisories.octopus.com/post/2022/sa2022-06/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.