cve-2022-2760
Vulnerability from cvelistv5
Published
2022-09-28 00:00
Modified
2024-08-03 00:46
Severity
Summary
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
References
| Source | URL | Tags |
|---|---|---|
| security@octopus.com | https://advisories.octopus.com/post/2022/sa2022-14/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product |
|---|---|
| Octopus Deploy | Octopus Server |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:46:04.424Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://advisories.octopus.com/post/2022/sa2022-14/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Octopus Server",
"vendor": "Octopus Deploy",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "2019.5.7",
"versionType": "custom"
},
{
"lessThan": "2022.1.3180",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "2022.2.6729",
"versionType": "custom"
},
{
"lessThan": "2022.2.7965",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "2022.3.348",
"versionType": "custom"
},
{
"lessThan": "2022.3.10586",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information exposure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-06T00:00:00",
"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"shortName": "Octopus"
},
"references": [
{
"url": "https://advisories.octopus.com/post/2022/sa2022-14/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"assignerShortName": "Octopus",
"cveId": "CVE-2022-2760",
"datePublished": "2022-09-28T00:00:00",
"dateReserved": "2022-08-11T00:00:00",
"dateUpdated": "2024-08-03T00:46:04.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-2760\",\"sourceIdentifier\":\"security@octopus.com\",\"published\":\"2022-09-28T12:15:09.553\",\"lastModified\":\"2022-09-29T16:37:39.780\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.\"},{\"lang\":\"es\",\"value\":\"En las versiones afectadas de Octopus Deploy es posible revelar el ID de espacio de los espacios a los que el usuario no presenta acceso para visualizar en un mensaje de error cuando un recurso es parte de otro espacio\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2019.5.7\",\"versionEndExcluding\":\"2022.1.3180\",\"matchCriteriaId\":\"F9DC4051-3DFD-433C-8532-5E46DD1AD73E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.2.0\",\"versionEndExcluding\":\"2022.2.7965\",\"matchCriteriaId\":\"CC30C541-36AD-40D0-9DC9-10717DFCB03C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.3.0\",\"versionEndExcluding\":\"2022.3.10405\",\"matchCriteriaId\":\"27D81A06-27A4-470B-B70F-78360B678F57\"}]}]}],\"references\":[{\"url\":\"https://advisories.octopus.com/post/2022/sa2022-14/\",\"source\":\"security@octopus.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
Loading...