Lucene search
OctopusCVE-2022-2572HistoryNov 01, 2022 - 2:15 a.m.
CVE-2022-2572
2022-11-0102:15:10
CWE-287
Octopus
web.nvd.nist.gov
24
8
octopus server
external authentication
api key
vulnerability
nvd
cve-2022-2572
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.5
Confidence
High
EPSS
0.002
Percentile
58.3%
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
Affected configurations
Node
octopusoctopus_serverRange3.5–2022.1.3264
ORoctopusoctopus_serverRange2022.2.6729–2022.2.8277
ORoctopusoctopus_serverRange2022.3.348–2022.3.10586
ORoctopusoctopus_serverRange2022.4.791–2022.4.2898
| Vendor | Product | Version | CPE |
|---|---|---|---|
| octopus | octopus_server | * | cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* |
CNA Affected
[
{
"vendor": "Octopus Deploy",
"product": "Octopus Server",
"versions": [
{
"version": "3.5",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.1.3264",
"status": "affected",
"versionType": "custom"
},
{
"version": "2022.2.6729",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.2.8277",
"status": "affected",
"versionType": "custom"
},
{
"version": "2022.3.348",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.3.10586",
"status": "affected",
"versionType": "custom"
},
{
"version": "2022.4.791",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.4.2898",
"status": "affected",
"versionType": "custom"
}
]
}
]Social References
More
Related
prion
prion
Authentication flaw
2022-11-01 02:15:00
cvelist
cvelist
CVE-2022-2572
2022-11-01 00:00:00
nvd
nvd
CVE-2022-2572
2022-11-01 02:15:10
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.5
Confidence
High
EPSS
0.002
Percentile
58.3%
Related for CVE-2022-2572