CVE-2022-4898

2023-01-3100:00:00

Octopus

www.cve.org

octopus server

cross-site scripting

support link

bypassed fix

xss

0.001 Low

EPSS

Percentile

21.2%

JSON

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS

CNA Affected

[
  {
    "vendor": "Octopus Deploy",
    "product": "Octopus Server",
    "versions": [
      {
        "version": "2019.7.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.2.8552",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "2022.3.348",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.3.10750",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "2022.4.791",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "2022.4.8319",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/post/2022/sa2023-01/

0.001 Low

EPSS

Percentile

21.2%

JSON

Related for CVELIST:CVE-2022-4898