Web Page Injection Vulnerability in Octopus Deploy
CVE-2022-2507

5.3MEDIUM

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
19 April 2023

What is CVE-2022-2507?

A vulnerability exists in Octopus Deploy that allows for the rendering of user-supplied input directly into web pages. This could potentially enable attackers to manipulate how content is displayed, leading to risks such as cross-site scripting (XSS) or unauthorized data exposure. Users are advised to update to the latest version to mitigate the risks associated with this issue.

Affected Version(s)

Octopus Server 0.9

Octopus Server 2022.3.348

Octopus Server < 2022.3.10957

References

https://advisories.octopus.com/post/2023/sa2023-06/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.