CVE-2022-2781

2022-10-0600:00:00

Octopus

www.cve.org

octopus server

encryption

session cookies

variables

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.

CNA Affected

[
  {
    "vendor": "Octopus Deploy",
    "product": "Octopus Server",
    "versions": [
      {
        "version": "3.2.10",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.1.3154",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "2022.2.6729",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.2.7897",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "2022.3.348",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.3.10586",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/post/2022/sa2022-16/