CVE-2022-2572

Published: Nov 1, 2022Modified: May 6, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.

Affected (4)

Products: Octopus: Octopus Server

Octopus

1 product

Octopus Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Octopus Octopus Server	From 2022.2.6729 to 2022.2.8277
Octopus Octopus Server	From 2022.3.348 to 2022.3.10586
Octopus Octopus Server	From 2022.4.791 to 2022.4.2898
Octopus Octopus Server	From 3.5 to 2022.1.3264

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://advisories.octopus.com/post/2022/sa2022-23/

Source: security@octopus.com

Vendor Advisory

https://advisories.octopus.com/post/2022/sa2022-23/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.