CVE-2022-2780 - In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack

Back Back to CVE browser

HIGH

In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack

Published Oct 14, 2022

8.1

HIGH

CVSS 3.1

EPSS 0.55%

Description

In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.

Affected products

Vendor Octopus Deploy Product Octopus Server Default
unknown
Affected
- ≥ 2021.2.994, < unspecified
- ≥ 2022.2.6729, < unspecified
- ≥ 2022.3.348, < unspecified
- ≥ unspecified, < 2022.1.3180
- ≥ unspecified, < 2022.2.7965
- ≥ unspecified, < 2022.3.10586

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Octopus Deploy	Octopus Server	unknown	Affected ≥ 2021.2.994, < unspecified ≥ 2022.2.6729, < unspecified ≥ 2022.3.348, < unspecified ≥ unspecified, < 2022.1.3180 ≥ unspecified, < 2022.2.7965 ≥ unspecified, < 2022.3.10586