CVE-2022-2828

published 2022-10-13

CVE-2022-2828: In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR)…

Priority P4 34 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Affected

9 ranges

Vendor	Product	Version range	Fixed in
octopus	octopus_server	2022.1.2121 – 2022.1.3135	—
octopus	octopus_server	2022.2.0 – 2022.2.7897	—
octopus	octopus_server	2022.3.0 – 2022.3.10586	—
octopus_deploy	octopus_server	>= 2022.1.2121 < unspecified	unspecified
octopus_deploy	octopus_server	>= 2022.2.6729 < unspecified	unspecified
octopus_deploy	octopus_server	>= 2022.3.348 < unspecified	unspecified
octopus_deploy	octopus_server	>= unspecified < 2022.1.3135	2022.1.3135
octopus_deploy	octopus_server	>= unspecified < 2022.2.7897	2022.2.7897
octopus_deploy	octopus_server	>= unspecified < 2022.3.10586	2022.3.10586

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639