Lucene search

[email protected]CVE-2022-2013

HistoryJun 13, 2022 - 12:15 a.m.

CVE-2022-2013

2022-06-1300:15:09

[email protected]

web.nvd.nist.gov

octopus server

cve-2022-2013

unauthorized access

script console

private spaces

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space.

Affected configurations

NVD

Node

octopusoctopus_deployRange2022.1.1495–2022.1.2647

AND

linuxlinux_kernelMatch-

microsoftwindowsMatch-

CPENameOperatorVersion
octopus:octopus_deployoctopus octopus deploylt2022.1.2647

CPE	Name	Operator	Version
octopus:octopus_deploy	octopus octopus deploy	lt	2022.1.2647

CNA Affected

[
  {
    "product": "Octopus Server",
    "vendor": "Octopus Deploy",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2022.1.1495",
        "versionType": "custom"
      },
      {
        "lessThan": "2022.1.2647",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/post/2022/sa2022-05/

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

Related for CVE-2022-2013

cvelist1 nvd1 prion1