Cross site scripting

2023-01-3104:15:00

PRIOn knowledge base

www.prio-n.com

cross-site scripting

octopus server

advisory 2022-07

support link

xss prevention

0.001 Low

EPSS

Percentile

21.2%

JSON

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS

CPENameOperatorVersion
octopus_serverge2022.4.791
octopus_serverlt2022.4.8319
octopus_serverge2022.3.348
octopus_serverlt2022.3.10750
octopus_serverge2019.7.0
octopus_serverlt2022.2.8552

Name	Operator	Version
octopus_server	ge	2022.4.791
octopus_server	lt	2022.4.8319
octopus_server	ge	2022.3.348
octopus_server	lt	2022.3.10750
octopus_server	ge	2019.7.0
octopus_server	lt	2022.2.8552

References

advisories.octopus.com/post/2022/sa2023-01/

0.001 Low

EPSS

Percentile

21.2%

JSON

Related for PRION:CVE-2022-4898