« Volver al listado

CVE-2022-2258

Estado: ModificadaMedia (4.3)—

In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Octopus — Octopus Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2258",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-2258",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-27T21:14:06.766838Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@octopus.com",
      "affectedData": [
        {
          "vendor": "Octopus Deploy",
          "product": "Octopus Server",
          "versions": [
            {
              "status": "affected",
              "version": "2019.1.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2022.3.11098",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2022.4.791",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2022.4.8463",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2023.1.4189",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2023.1.9672",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-03-13T05:15:11.330",
  "references": [
    {
      "url": "https://advisories.octopus.com/post/2023/sa2023-03/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@octopus.com"
    },
    {
      "url": "https://advisories.octopus.com/post/2023/sa2023-03/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items"
    }
  ],
  "lastModified": "2026-06-17T04:41:34.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9D751BC-2DB1-41A2-AD4F-708D30C4A65B",
              "versionEndExcluding": "2022.3.11098",
              "versionStartIncluding": "2019.1.0"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53410B74-CA81-4DD2-B12D-C5CD3CF1F688",
              "versionEndExcluding": "2022.4.8463",
              "versionStartIncluding": "2022.4.791"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC3AE741-78FE-4242-A3BC-209296AB5DBA",
              "versionEndExcluding": "2023.1.9672",
              "versionStartIncluding": "2023.1.4189"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:2023.2.2028:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83DE5481-615F-40C7-81F9-8006CE72E37D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@octopus.com"
}