CVE-2022-2783 - In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token · CoreCVE

Back Back to CVE browser

MEDIUM

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token

Published Oct 6, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token

Affected products

Vendor Octopus Deploy Product Octopus Server Default
n/a
- Version
  2022.2.6729
  Status
  affected
  Constraints
  <unspecified
- Version
  2022.3.348
  Status
  affected
  Constraints
  <unspecified
- Version
  3.12.0
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <2022.1.3154
- Version
  unspecified
  Status
  affected
  Constraints
  <2022.2.7897
- Version
  unspecified
  Status
  affected
  Constraints
  <2022.3.10586

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
2022.2.6729	affected	<unspecified
2022.3.348	affected	<unspecified
3.12.0	affected	<unspecified
unspecified	affected	<2022.1.3154
unspecified	affected	<2022.2.7897
unspecified	affected	<2022.3.10586

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (1)

https://advisories.octopus.com/post/2022/sa2022-17/
Vendor Advisory

Link	Providers	Tags
https://advisories.octopus.com/post/2022/sa2022-17/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Octopus

Published Oct 6, 2022

Updated Aug 3, 2024

Reserved Aug 11, 2022

Link CVE-2022-2783

CISA Vulnrichment

Updated n/a

Status Modified

Modified Jun 17, 2026

Link CVE-2022-2783

Severity n/a

Public date n/a

Links CVE-2022-2783

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a