CVE-2022-2828 - In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Back Back to CVE browser

MEDIUM

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Published Oct 13, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.58%

Description

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Affected products

Vendor Octopus Deploy Product Octopus Server Default
n/a
- Version
  2022.1.2121
  Status
  affected
  Constraints
  <unspecified
- Version
  2022.2.6729
  Status
  affected
  Constraints
  <unspecified
- Version
  2022.3.348
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <2022.1.3135
- Version
  unspecified
  Status
  affected
  Constraints
  <2022.2.7897
- Version
  unspecified
  Status
  affected
  Constraints
  <2022.3.10586

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Octopus Deploy

Octopus Server

n/a

Version	Status	Constraints
2022.1.2121	affected	<unspecified
2022.2.6729	affected	<unspecified
2022.3.348	affected	<unspecified
unspecified	affected	<2022.1.3135
unspecified	affected	<2022.2.7897
unspecified	affected	<2022.3.10586