CVE-2022-1881 (GCVE-0-2022-1881)
Vulnerability from cvelistv5 – Published: 2022-07-15 07:40 – Updated: 2024-08-03 00:17
VLAI
EPSS
VEX
Summary
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
Severity
5.3 (Medium)
CWE
- Insecure Direct Object Reference (IDOR)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://advisories.octopus.com/post/2022/sa2022-06/ | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Octopus Deploy | Octopus Server |
Affected:
2021.1.1 , < unspecified
(custom)
Affected: unspecified , < 2021.3.13021 (custom) Affected: 2022.1.2121 , < unspecified (custom) Affected: unspecified , < 2022.1.2894 (custom) Affected: 2022.2.6729 , < unspecified (custom) Affected: unspecified , < 2022.2.6971 (custom) Affected: 2022.3.348 , < unspecified (custom) Affected: unspecified , < 2022.3.2616 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:17:00.929Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://advisories.octopus.com/post/2022/sa2022-06/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Octopus Server",
"vendor": "Octopus Deploy",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "2021.1.1",
"versionType": "custom"
},
{
"lessThan": "2021.3.13021",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "2022.1.2121",
"versionType": "custom"
},
{
"lessThan": "2022.1.2894",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "2022.2.6729",
"versionType": "custom"
},
{
"lessThan": "2022.2.6971",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "2022.3.348",
"versionType": "custom"
},
{
"lessThan": "2022.3.2616",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Insecure Direct Object Reference (IDOR)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-15T07:40:10.000Z",
"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"shortName": "Octopus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://advisories.octopus.com/post/2022/sa2022-06/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@octopus.com",
"ID": "CVE-2022-1881",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Octopus Server",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_value": "2021.1.1"
},
{
"version_affected": "\u003c",
"version_value": "2021.3.13021"
},
{
"version_affected": "\u003e=",
"version_value": "2022.1.2121"
},
{
"version_affected": "\u003c",
"version_value": "2022.1.2894"
},
{
"version_affected": "\u003e=",
"version_value": "2022.2.6729"
},
{
"version_affected": "\u003c",
"version_value": "2022.2.6971"
},
{
"version_affected": "\u003e=",
"version_value": "2022.3.348"
},
{
"version_affected": "\u003c",
"version_value": "2022.3.2616"
}
]
}
}
]
},
"vendor_name": "Octopus Deploy"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insecure Direct Object Reference (IDOR)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://advisories.octopus.com/post/2022/sa2022-06/",
"refsource": "MISC",
"url": "https://advisories.octopus.com/post/2022/sa2022-06/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
"assignerShortName": "Octopus",
"cveId": "CVE-2022-1881",
"datePublished": "2022-07-15T07:40:10.000Z",
"dateReserved": "2022-05-25T00:00:00.000Z",
"dateUpdated": "2024-08-03T00:17:00.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-1881",
"date": "2026-07-16",
"epss": "0.00523",
"percentile": "0.4085"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-1881\",\"sourceIdentifier\":\"security@octopus.com\",\"published\":\"2022-07-15T08:15:07.130\",\"lastModified\":\"2026-06-17T04:23:16.377\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.\"},{\"lang\":\"es\",\"value\":\"En las versiones afectadas de Octopus Server se presenta una vulnerabilidad de Referencia Directa de Objetos Insegura donde es posible que un usuario descargue Exportaciones de Proyectos desde un Proyecto al que no presenta permisos para acceder. Esta vulnerabilidad s\u00f3lo afecta a proyectos dentro del mismo espacio\"}],\"affected\":[{\"source\":\"security@octopus.com\",\"affectedData\":[{\"vendor\":\"Octopus Deploy\",\"product\":\"Octopus Server\",\"versions\":[{\"version\":\"2021.1.1\",\"lessThan\":\"unspecified\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"unspecified\",\"lessThan\":\"2021.3.13021\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2022.1.2121\",\"lessThan\":\"unspecified\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"unspecified\",\"lessThan\":\"2022.1.2894\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2022.2.6729\",\"lessThan\":\"unspecified\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"unspecified\",\"lessThan\":\"2022.2.6971\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2022.3.348\",\"lessThan\":\"unspecified\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"unspecified\",\"lessThan\":\"2022.3.2616\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.1.6959\",\"versionEndExcluding\":\"2021.3.13021\",\"matchCriteriaId\":\"3CB7AF7F-0376-45A0-A583-6875D741D5ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.1.2121\",\"versionEndExcluding\":\"2022.1.2894\",\"matchCriteriaId\":\"6D60FEF9-B28B-451B-860D-8C360CBC51F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.2.6729\",\"versionEndExcluding\":\"2022.2.6971\",\"matchCriteriaId\":\"61CF70DB-340C-480F-A848-38A61DBF87B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.3.348\",\"versionEndExcluding\":\"2022.3.2616\",\"matchCriteriaId\":\"7D8CAF0C-9FB7-45E9-8ECA-5EBAAD34079D\"}]}]}],\"references\":[{\"url\":\"https://advisories.octopus.com/post/2022/sa2022-06/\",\"source\":\"security@octopus.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://advisories.octopus.com/post/2022/sa2022-06/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"current_release_date": "2026-03-27T13:02:17+00:00",
"cve": "CVE-2022-1881",
"id": "CVE-2022-1881",
"initial_release_date": "2022-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2022-1881",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-1881.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…