Lucene search
HistoryNov 01, 2022 - 2:15 a.m.
CVE-2022-2572
octopus server
external authentication
api key
user access
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
58.3%
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
Affected configurations
Node
octopusoctopus_serverRange3.5–2022.1.3264
ORoctopusoctopus_serverRange2022.2.6729–2022.2.8277
ORoctopusoctopus_serverRange2022.3.348–2022.3.10586
ORoctopusoctopus_serverRange2022.4.791–2022.4.2898
| Vendor | Product | Version | CPE |
|---|---|---|---|
| octopus | octopus_server | * | cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* |
Related
prion
prion
Authentication flaw
2022-11-01 02:15:00
cvelist
cvelist
CVE-2022-2572
2022-11-01 00:00:00
cve
cve
CVE-2022-2572
2022-11-01 02:15:10
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
58.3%
Related for NVD:CVE-2022-2572