Lucene search

OctopusCVE-2022-4870

HistoryMay 18, 2023 - 12:15 a.m.

CVE-2022-4870

2023-05-1800:15:09

CWE-209

Octopus

web.nvd.nist.gov

octopus deploy

cve-2022-4870

network details disclosure

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

In affected versions of Octopus Deploy it is possible to discover network details via error message

Affected configurations

Nvd

Node

octopusoctopus_serverRange3.0.0–2023.1.9879

octopusoctopus_serverRange2023.2.2028–2023.2.8159

VendorProductVersionCPE
octopusoctopus_server*cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
octopus	octopus_server	*	cpe:2.3:a:octopus:octopus_server::::::::

CNA Affected

[
  {
    "vendor": "Octopus Deploy",
    "product": "Octopus Server",
    "versions": [
      {
        "version": "3.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2023.1.9879",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/post/2023/sa2023-09/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

Related for CVE-2022-4870