PT-2022-14370 · Unknown · Octopus Server

Published 2022-06-12 · Updated 2022-06-17 · CVE-2022-2013

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Octopus Server versions 2022.1.1495 through 2022.1.2647

Description The issue allows new users to access the Script Console within their private space if private spaces were enabled via the experimental feature flag.

Recommendations For versions 2022.1.1495 through 2022.1.2647, update to version 2022.1.2647 or later to resolve the issue.

Fix

Related Identifiers

CVE-2022-2013

Affected Products

Octopus Server

References · 5

• https://advisories.octopus.com/post/2022/sa2022-05 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2013 · Security Note
• https://t.me/cvenotify/31485 · Telegram Post
• https://t.me/cibsecurity/44243 · Telegram Post