Octopus Deploy Security Advisories
Home
Advisories icon
2021 2022
Severity Levels
Disclosure Policy

  • Security Advisory 2022-17

    Oct 6, 2022 · Vulnerability/CSRF Severity/medium CVSS/6.3

    Session cookie can be used as the CSRF token (CVE-2022-2783)

    Read More

  • Security Advisory 2022-16

    Oct 5, 2022 · Vulnerability/Encryption Severity/medium CVSS/5.5

    Encrypted variables and session cookies use the same encryption process (CVE-2022-2781)

    Read More

  • Security Advisory 2022-15

    Sep 27, 2022 · Vulnerability/Rate limit bypass Severity/low CVSS/2.2

    Login password rate limit can be bypassed with null bytes (CVE-2022-2778)

    Read More

  • Security Advisory 2022-14

    Sep 27, 2022 · Vulnerability/Information exposure Severity/low CVSS/3.0

    Space ID is revealed in error messages when the resource is part of another space (CVE-2022-2760)

    Read More

  • Security Advisory 2022-13

    Sep 9, 2022 · Vulnerability/Broken access control Severity/medium CVSS/6.4

    Service Account with FeedView permission can upload to built-in feed after re-indexing packages (CVE-2022-2528)

    Read More

  • Security Advisory 2022-12

    Aug 19, 2022 · Vulnerability/Regex Denial of Service Severity/medium CVSS/6.5

    ReDoS in Build Information request (CVE-2022-2075)

    Read More

  • Security Advisory 2022-11

    Aug 19, 2022 · Vulnerability/Regex Denial of Service Severity/high CVSS/7.1

    ReDoS in Variable Project Templates (CVE-2022-2074)

    Read More

  • Security Advisory 2022-10

    Aug 19, 2022 · Vulnerability/Regex Denial of Service Severity/medium CVSS/5.3

    ReDoS in Package Upload Files (CVE-2022-2049)

    Read More

  • Security Advisory 2022-09

    Aug 19, 2022 · Vulnerability/sensitive variable exposure Severity/medium CVSS/6.8

    Sensitive variable value displayed in Variable Preview (CVE-2022-1901)

    Read More

  • Security Advisory 2022-08

    Jul 18, 2022 · Vulnerability/Logging Severity/medium CVSS/6.4

    Lack of auditing and logging for artifacts in Octopus Server (CVE-2022-30532)

    Read More
    • ««
    • «
    • 1
    • 2
    • 3
    • 4
    • 5
    • »
    • »»

Recent Security Advisories

  • Security Advisory 2022-27
  • Security Advisory 2022-26
  • Security Advisory 2022-25
  • Security Advisory 2022-24
  • Security Advisory 2022-23
  • Security Advisory 2022-22
  • Security Advisory 2022-21
  • Security Advisory 2022-20

Products

OCTOPUS-SERVER 34 OCTOPUS-DEPLOY-TEAMCITY-PLUGIN 3 OCTOPUS-JAVA-SDK 3 OCTOPUS-TENTACLE 3 HALIBUT 1

Tags

SEVERITY/MEDIUM 24 SEVERITY/HIGH 10 SEVERITY/LOW 10 VULNERABILITY/VULNERABLE-DEPENDENCY 6 VULNERABILITY/CLEAR-TEXT-STORAGE-OF-SENSITIVE-VALUE 5 VULNERABILITY/BROKEN-ACCESS-CONTROL 4 VULNERABILITY/INFORMATION-EXPOSURE 4 CVSS/5.7 3 CVSS/6.4 3 CVSS/6.8 3 VULNERABILITY/LOCAL-PRIVILEGE-ESCALATION 3 VULNERABILITY/REGEX-DENIAL-OF-SERVICE 3 VULNERABILITY/REMOTE-CODE-EXECUTION 3 CVSS/6.3 2
All Tags
CVSS/2.21 CVSS/2.41 CVSS/3.01 CVSS/3.41 CVSS/3.61 CVSS/4.11 CVSS/4.31 CVSS/5.31 CVSS/5.41 CVSS/5.51 CVSS/5.73 CVSS/5.91 CVSS/6.32 CVSS/6.43 CVSS/6.52 CVSS/6.83 CVSS/7.11 CVSS/7.31 CVSS/8.01 SEVERITY/HIGH10 SEVERITY/LOW10 SEVERITY/MEDIUM24 VULNERABILITY/ABNORMAL-INVITE-CODE-FUNCTIONALITY1 VULNERABILITY/AUTHENTICATION-BYPASS-BY-CAPTURE-REPLAY1 VULNERABILITY/AUTHENTICATION-BYPASS-USING-AN-ALTERNATE-PATH-OR-CHANNEL1 VULNERABILITY/BROKEN-ACCESS-CONTROL4 VULNERABILITY/CLEAR-TEXT-STORAGE-OF-SENSITIVE-VALUE5 VULNERABILITY/CSRF1 VULNERABILITY/ENCRYPTION1 VULNERABILITY/EXPOSURE-OF-SENSITIVE-INFORMATION-THROUGH-ENVIRONMENTAL-VARIABLES1 VULNERABILITY/INFORMATION-EXPOSURE4 VULNERABILITY/INSECURE-DIRECT-OBJECT-REFERENCE-IDOR1 VULNERABILITY/INSERTION-OF-SENSITIVE-INFORMATION-INTO-LOG-FILE1 VULNERABILITY/INSUFFICIENT-SESSION-EXPIRATION1 VULNERABILITY/LOCAL-PRIVILEGE-ESCALATION3 VULNERABILITY/LOGGING1 VULNERABILITY/OPEN-REDIRECT1 VULNERABILITY/RATE-LIMIT-BYPASS1 VULNERABILITY/REGEX-DENIAL-OF-SERVICE3 VULNERABILITY/REMOTE-CODE-EXECUTION3 VULNERABILITY/SENSITIVE-VARIABLE-EXPOSURE1 VULNERABILITY/SQL-INJECTION1 VULNERABILITY/STORED-XSS2 VULNERABILITY/VULNERABLE-DEPENDENCY6
[A~Z][0~9]
Octopus Deploy Security Advisories

Copyright   OCTOPUS DEPLOY SECURITY ADVISORIES. All Rights Reserved