Code injection

2023-03-1604:15:00

PRIOn knowledge base

www.prio-n.com

octopus deploy

code injection

offline package

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.2%

JSON

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation

CPENameOperatorVersion
octopus_serverge2022.4.791
octopus_serverlt2022.4.8319
octopus_serverge2022.3.348
octopus_serverlt2022.3.10750
octopus_serverge3.0.19
octopus_serverlt2022.2.8552

Name	Operator	Version
octopus_server	ge	2022.4.791
octopus_server	lt	2022.4.8319
octopus_server	ge	2022.3.348
octopus_server	lt	2022.3.10750
octopus_server	ge	3.0.19
octopus_server	lt	2022.2.8552

References

advisories.octopus.com/post/2023/sa2023-05/