CVE-2022-2828

State: Published
Severity: 6.5 Medium
Published: Oct 13, 2022
Updated: May 15, 2025
Reserved: Aug 16, 2022

Description

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Octopus ServerOctopus Deploy	2022.1.2121 to before unspecifiedAffected before 2022.1.3135Affected 2022.2.6729 to before unspecifiedAffected before 2022.2.7897Affected 2022.3.348 to before unspecifiedAffected before 2022.3.10586Affected

References

https://advisories.octopus.com/post/2022/sa2022-19/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.