Lucene search
HistoryOct 14, 2022 - 7:15 a.m.
CVE-2022-2780
octopus server
git connectivity
vcs project
smb request
ntlm relay attack
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
58.3%
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
Affected configurations
Node
octopusoctopus_serverRange2021.2.994–2022.1.3180
ORoctopusoctopus_serverRange2022.2.6729–2022.2.7965
ORoctopusoctopus_serverRange2022.3.348–2022.3.10586
| Vendor | Product | Version | CPE |
|---|---|---|---|
| octopus | octopus_server | * | cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* |
Related
cve
cve
CVE-2022-2780
2022-10-14 07:15:08
prion
prion
Cross site request forgery (csrf)
2022-10-14 07:15:00
cvelist
cvelist
CVE-2022-2780
2022-10-14 00:00:00
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
58.3%
Related for NVD:CVE-2022-2780