CVE-2022-2572

Published: Nov 1, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.

Affected (4)

Products: Octopus: Octopus Server

Octopus

1 product

Octopus Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Octopus Octopus Server	2022.2.6729 ≤ version < 2022.2.8277
Octopus Octopus Server	2022.3.348 ≤ version < 2022.3.10586
Octopus Octopus Server	2022.4.791 ≤ version < 2022.4.2898
Octopus Octopus Server	3.5 ≤ version < 2022.1.3264

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://advisories.octopus.com/post/2022/sa2022-23/

Source: security@octopus.com

Vendor Advisory

https://advisories.octopus.com/post/2022/sa2022-23/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.