Indefinite Session Token Vulnerability in Octopus Server by Octopus Deploy
CVE-2022-2782

9.1CRITICAL

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
27 October 2022

What is CVE-2022-2782?

In affected versions of Octopus Server, improper validation of session token parameters can lead to session tokens being valid indefinitely. This flaw poses a risk as it allows unauthorized access, potentially allowing malicious actors to exploit valid tokens to perform actions without needing proper authentication.

Affected Version(s)

Octopus Server 0.9

Octopus Server < 2022.2.8351

Octopus Server 2022.3.348

References

https://advisories.octopus.com/post/2022/sa2022-21/

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.