Lucene search
OctopusCVE-2022-2780HistoryOct 14, 2022 - 7:15 a.m.
CVE-2022-2780
2022-10-1407:15:08
CWE-294
Octopus
web.nvd.nist.gov
29
4
cve-2022-2780
octopus server
vcs
git
smb
ntlm
relay attack
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
8
Confidence
High
EPSS
0.002
Percentile
58.3%
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
Affected configurations
Node
octopusoctopus_serverRange2021.2.994–2022.1.3180
ORoctopusoctopus_serverRange2022.2.6729–2022.2.7965
ORoctopusoctopus_serverRange2022.3.348–2022.3.10586
| Vendor | Product | Version | CPE |
|---|---|---|---|
| octopus | octopus_server | * | cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* |
CNA Affected
[
{
"vendor": "Octopus Deploy",
"product": "Octopus Server",
"versions": [
{
"version": "2021.2.994",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.1.3180",
"status": "affected",
"versionType": "custom"
},
{
"version": "2022.2.6729",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.2.7965",
"status": "affected",
"versionType": "custom"
},
{
"version": "2022.3.348",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.3.10586",
"status": "affected",
"versionType": "custom"
}
]
}
]Social References
More
Related
nvd
nvd
CVE-2022-2780
2022-10-14 07:15:08
cvelist
cvelist
CVE-2022-2780
2022-10-14 00:00:00
prion
prion
Cross site request forgery (csrf)
2022-10-14 07:15:00
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
8
Confidence
High
EPSS
0.002
Percentile
58.3%
Related for CVE-2022-2780