CVE-2022-2760

Published: Sep 28, 2022Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.

Affected (3)

Products: Octopus: Octopus Server

Octopus

1 product

Octopus Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Octopus Octopus Server	From 2019.5.7 to 2022.1.3180
Octopus Octopus Server	From 2022.2.0 to 2022.2.7965
Octopus Octopus Server	From 2022.3.0 to 2022.3.10405

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (2)

https://advisories.octopus.com/post/2022/sa2022-14/

Source: security@octopus.com

PatchVendor Advisory

https://advisories.octopus.com/post/2022/sa2022-14/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.