CVE-2022-2760

State: Published
Severity: 4.3 Medium
Published: Sep 28, 2022
Updated: May 21, 2025
Reserved: Aug 11, 2022

Description

In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
Octopus ServerOctopus Deploy	2019.5.7 to before unspecifiedAffected before 2022.1.3180Affected 2022.2.6729 to before unspecifiedAffected before 2022.2.7965Affected 2022.3.348 to before unspecifiedAffected before 2022.3.10586Affected

References

https://advisories.octopus.com/post/2022/sa2022-14/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.