Design/Logic Flaw

2022-09-3004:15:00

PRIOn knowledge base

www.prio-n.com

design logic flaw

octopus deploy

null bytes

rate limiting

nvd

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.5%

JSON

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.

CPENameOperatorVersion
octopus_serverge3.0
octopus_serverlt2022.2.8277
octopus_serverge2022.3.348
octopus_serverlt2022.3.10405
octopus_serverge2022.4.791
octopus_serverlt2022.4.1371

Name	Operator	Version
octopus_server	ge	3.0
octopus_server	lt	2022.2.8277
octopus_server	ge	2022.3.348
octopus_server	lt	2022.3.10405
octopus_server	ge	2022.4.791
octopus_server	lt	2022.4.1371

References

advisories.octopus.com/post/2022/sa2022-15/