Lucene search
HistoryMay 10, 2023 - 6:15 a.m.
CVE-2022-4008
octopus deploy
zipbomb
file upload
dos
cve-2022-4008
nvd
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
5.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
12.9%
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
Affected configurations
Node
octopusoctopus_serverRange0.9–2022.3.11043
ORoctopusoctopus_serverRange2022.4.791–2022.4.8401
CNA Affected
[
{
"vendor": "Octopus Deploy",
"product": "Octopus Tentacle",
"versions": [
{
"version": "0.9",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.3.11043",
"status": "affected",
"versionType": "custom"
},
{
"version": "2022.4.791",
"status": "affected",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"version": "unspecified",
"lessThan": "2022.4.8401",
"status": "affected",
"versionType": "custom"
}
]
}
]Related
prion
prion
Denial of service
2023-05-10 06:15:00
nvd
nvd
CVE-2022-4008
2023-05-10 06:15:09
cvelist
cvelist
CVE-2022-4008
2023-05-10 00:00:00
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
5.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
12.9%
Related for CVE-2022-4008