CVE-2022-2760
published 2022-09-28CVE-2022-2760: In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a…
PriorityP418medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.43%
34.8th percentile
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| octopus | octopus_server | >= 2019.5.7 < 2022.1.3180 | 2022.1.3180 |
| octopus | octopus_server | >= 2022.2.0 < 2022.2.7965 | 2022.2.7965 |
| octopus | octopus_server | >= 2022.3.0 < 2022.3.10405 | 2022.3.10405 |
| octopus_deploy | octopus_server | >= 2019.5.7 < unspecified | unspecified |
| octopus_deploy | octopus_server | >= 2022.2.6729 < unspecified | unspecified |
| octopus_deploy | octopus_server | >= 2022.3.348 < unspecified | unspecified |
| octopus_deploy | octopus_server | >= unspecified < 2022.1.3180 | 2022.1.3180 |
| octopus_deploy | octopus_server | >= unspecified < 2022.2.7965 | 2022.2.7965 |
| octopus_deploy | octopus_server | >= unspecified < 2022.3.10586 | 2022.3.10586 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Octopus Deploy Space ID information exposure (EUVD-2022-35002)
vuldb·2026-05-27·CVSS 4.3
CVE-2022-2760 [MEDIUM] Octopus Deploy Space ID information exposure (EUVD-2022-35002)
A vulnerability categorized as problematic has been discovered in Octopus Deploy. This issue affects some unknown processing of the component Space ID Handler. Executing a manipulation can lead to information exposure through error message.
This vulnerability is handled as CVE-2022-2760. The attack can be executed remotely. There is not any exploit available.
GHSA
GHSA-x537-5w7x-8g44: In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message
ghsa_unreviewed·2022-09-29
CVE-2022-2760 [MEDIUM] CWE-209 GHSA-x537-5w7x-8g44: In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-28
Published