Code Injection Vulnerability in Octopus Deploy by Octopus Deploy
CVE-2022-4009

8.8HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
16 March 2023

What is CVE-2022-4009?

In vulnerable versions of Octopus Deploy, a flaw exists that allows users to introduce arbitrary code during the offline package creation process. This vulnerability can potentially lead to unauthorized access and execution of malicious code, compromising the integrity of the deployment pipeline.

Affected Version(s)

Octopus Server 3.0.19

Octopus Server < 2022.2.8552

Octopus Server 2022.3.348

References

https://advisories.octopus.com/post/2023/sa2023-05/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.