Octopus Deploy Octopus Server

CVE-2022-3460

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 0.57 % · centile 47 (2026-11-01)
État: PUBLISHED
Publiée: 2023-01-02 00:00 UTC
Mise à jour: 2025-04-10 15:25 UTC
Attribuée par: Octopus
Statut NVD: Modified

Rechercher sur…

Description

In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.

Faiblesses (CWE)

CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
CWE-212 — Suppression incorrecte d'informations sensibles avant stockage ou transfert

Références

https://advisories.octopus.com/post/2022/sa2022-25/

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

ENISA EUVD · EUVD-2022-42832
GCVE · GCVE-0-2022-3460

Configurations affectées (CPE NVD)

cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* ≥ 2018.1.0 < 2022.3.10750
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* ≥ 2022.4 < 2022.4.8063

Produits affectés

Produit	Versions
Octopus Deploy · Octopus Server	affected 2018.3.1 < unspecified ; affected unspecified < 2021.3.13150 ; affected 2022.1.2121 < unspecified ; affected unspecified < 2022.1.3281 ; affected 2022.2.7897 < unspecified ; affected unspecified < 2022.2.8552

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD