Design/Logic Flaw

2022-10-1305:15:00

PRIOn knowledge base

www.prio-n.com

octopus server

flaw

information disclosure

api

insecure direct object reference

vulnerability

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

CPENameOperatorVersion
octopus_serverge2022.3.0
octopus_serverle2022.3.10586
octopus_serverge2022.2.0
octopus_serverle2022.2.7897
octopus_serverge2022.1.2121
octopus_serverle2022.1.3135

Name	Operator	Version
octopus_server	ge	2022.3.0
octopus_server	le	2022.3.10586
octopus_server	ge	2022.2.0
octopus_server	le	2022.2.7897
octopus_server	ge	2022.1.2121
octopus_server	le	2022.1.3135

References

advisories.octopus.com/post/2022/sa2022-19/