Lucene search

[email protected]CVE-2022-2259

HistoryMar 13, 2023 - 5:15 a.m.

CVE-2022-2259

2023-03-1305:15:11

[email protected]

web.nvd.nist.gov

octopus deploy

cve-2022-2259

unauthorized access

workerpools

security vulnerability

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items

Affected configurations

NVD

Node

octopusoctopus_serverRange2019.1.0–2022.3.11098

octopusoctopus_serverRange2022.4.791–2022.4.8463

octopusoctopus_serverRange2023.1.4189–2023.1.9672

octopusoctopus_serverMatch2023.2.2028

CPENameOperatorVersion
octopus:octopus_serveroctopus octopus serverlt2022.3.11098
octopus:octopus_serveroctopus octopus serverlt2022.4.8463
octopus:octopus_serveroctopus octopus serverlt2023.1.9672
octopus:octopus_serveroctopus octopus servereq2023.2.2028

CPE	Name	Operator	Version
octopus:octopus_server	octopus octopus server	lt	2022.3.11098
octopus:octopus_server	octopus octopus server	lt	2022.4.8463
octopus:octopus_server	octopus octopus server	lt	2023.1.9672
octopus:octopus_server	octopus octopus server	eq	2023.2.2028

CNA Affected

[
  {
    "vendor": "Octopus Deploy",
    "product": "Octopus Server",
    "versions": [
      {
        "version": "2019.1.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.3.11098",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "2022.4.791",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.4.8463",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "2023.1.4189",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2023.1.9672",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/post/2023/sa2023-04/

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

Related for CVE-2022-2259

cvelist1 prion1 nvd1