Denial of Service Vulnerability in Octopus Deploy by Octopus Deploy
CVE-2022-4008

5.5MEDIUM

Key Information:

Vendor

Octopus Deploy

Status
Octopus Tentacle
Vendor
CVE Published:
10 May 2023

What is CVE-2022-4008?

A security flaw in Octopus Deploy allows the uploading of zipbomb files, which can significantly degrade system performance and lead to a Denial of Service. An attacker can exploit this vulnerability by submitting a specially crafted zip file that expands to consume excessive resources, ultimately disrupting service availability.

Affected Version(s)

Octopus Tentacle 0.9

Octopus Tentacle < 2022.3.11043

Octopus Tentacle 2022.4.791

References

https://advisories.octopus.com/post/2023/sa2023-08/

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.