CVE-2022-1881

published 2022-07-15

CVE-2022-1881: In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports…

Priority P4 27 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
octopus	octopus_server	>= 2021.1.6959 < 2021.3.13021	2021.3.13021
octopus	octopus_server	>= 2022.1.2121 < 2022.1.2894	2022.1.2894
octopus	octopus_server	>= 2022.2.6729 < 2022.2.6971	2022.2.6971
octopus	octopus_server	>= 2022.3.348 < 2022.3.2616	2022.3.2616
octopus_deploy	octopus_server	>= 2021.1.1 < unspecified	unspecified
octopus_deploy	octopus_server	>= 2022.1.2121 < unspecified	unspecified
octopus_deploy	octopus_server	>= 2022.2.6729 < unspecified	unspecified
octopus_deploy	octopus_server	>= 2022.3.348 < unspecified	unspecified
octopus_deploy	octopus_server	>= unspecified < 2021.3.13021	2021.3.13021
octopus_deploy	octopus_server	>= unspecified < 2022.1.2894	2022.1.2894
octopus_deploy	octopus_server	>= unspecified < 2022.2.6971	2022.2.6971
octopus_deploy	octopus_server	>= unspecified < 2022.3.2616	2022.3.2616

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639