« Volver al listado

CVE-2022-1881

Estado: ModificadaMedia (5.3)—

In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Octopus — Octopus Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1881",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@octopus.com",
      "affectedData": [
        {
          "vendor": "Octopus Deploy",
          "product": "Octopus Server",
          "versions": [
            {
              "status": "affected",
              "version": "2021.1.1",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2021.3.13021",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2022.1.2121",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2022.1.2894",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2022.2.6729",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2022.2.6971",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2022.3.348",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2022.3.2616",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-15T08:15:07.130",
  "references": [
    {
      "url": "https://advisories.octopus.com/post/2022/sa2022-06/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@octopus.com"
    },
    {
      "url": "https://advisories.octopus.com/post/2022/sa2022-06/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space."
    },
    {
      "lang": "es",
      "value": "En las versiones afectadas de Octopus Server se presenta una vulnerabilidad de Referencia Directa de Objetos Insegura donde es posible que un usuario descargue Exportaciones de Proyectos desde un Proyecto al que no presenta permisos para acceder. Esta vulnerabilidad sólo afecta a proyectos dentro del mismo espacio"
    }
  ],
  "lastModified": "2026-06-17T04:23:16.377",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CB7AF7F-0376-45A0-A583-6875D741D5ED",
              "versionEndExcluding": "2021.3.13021",
              "versionStartIncluding": "2021.1.6959"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D60FEF9-B28B-451B-860D-8C360CBC51F6",
              "versionEndExcluding": "2022.1.2894",
              "versionStartIncluding": "2022.1.2121"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61CF70DB-340C-480F-A848-38A61DBF87B5",
              "versionEndExcluding": "2022.2.6971",
              "versionStartIncluding": "2022.2.6729"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D8CAF0C-9FB7-45E9-8ECA-5EBAAD34079D",
              "versionEndExcluding": "2022.3.2616",
              "versionStartIncluding": "2022.3.348"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@octopus.com"
}