Vulnerabilities > CVE-2022-1881 - Authorization Bypass Through User-Controlled Key vulnerability in Octopus Server

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

octopus

CWE-639

NVD

Published: 2022-07-15

Updated: 2024-11-21

Summary

In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.

Vulnerable Configurations

Part	Description	Count
Application	Octopus Octopus Octopus Server 2021.1.6959 Octopus Octopus Server 2021.1.7149 Octopus Octopus Server 2021.1.7198 Octopus Octopus Server 2021.1.7236 Octopus Octopus Server 2021.1.7316 Octopus Octopus Server 2021.1.7469 Octopus Octopus Server 2021.1.7500 Octopus Octopus Server 2021.1.7595 Octopus Octopus Server 2021.1.7608 Octopus Octopus Server 2021.1.7638 Octopus Octopus Server 2021.1.7665 Octopus Octopus Server 2021.1.7738 Octopus Octopus Server 2021.1.7782 Octopus Octopus Server 2021.1.7787 Octopus Octopus Server 2021.1.7818 Octopus Octopus Server 2021.1.7826 Octopus Octopus Server 2021.1.7849 Octopus Octopus Server 2021.1.7853 Octopus Octopus Server 2021.1.7856 Octopus Octopus Server 2021.1.7906 Octopus Octopus Server 2021.1.8018 Octopus Octopus Server 2021.2.0 Octopus Octopus Server 2021.2.994 Octopus Octopus Server 2021.2.7428 Octopus Octopus Server 2021.2.7462 Octopus Octopus Server 2021.2.7529 Octopus Octopus Server 2021.2.7580 Octopus Octopus Server 2021.2.7650 Octopus Octopus Server 2021.2.7693 Octopus Octopus Server 2021.2.7697 Octopus Octopus Server 2021.2.7705 Octopus Octopus Server 2021.2.7706 Octopus Octopus Server 2021.2.7713 Octopus Octopus Server 2021.2.7724 Octopus Octopus Server 2021.2.7727 Octopus Octopus Server 2021.2.7805 Octopus Octopus Server 2021.2.7808 Octopus Octopus Server 2021.2.7821 Octopus Octopus Server 2021.2.7828 Octopus Octopus Server 2021.2.7840 Octopus Octopus Server 2021.2.7841 Octopus Octopus Server 2021.2.7847 Octopus Octopus Server 2021.2.7852 Octopus Octopus Server 2021.2.7857 Octopus Octopus Server 2021.2.7865 Octopus Octopus Server 2021.2.7870 Octopus Octopus Server 2021.2.7879 Octopus Octopus Server 2021.2.7897 Octopus Octopus Server 2021.2.7899 Octopus Octopus Server 2021.2.7924 Octopus Octopus Server 2021.2.7939 Octopus Octopus Server 2021.2.7952 Octopus Octopus Server 2021.2.8001 Octopus Octopus Server 2021.2.8011 Octopus Octopus Server 2021.2.8012 Octopus Octopus Server 2021.2.8043 Octopus Octopus Server 2021.2.8062 Octopus Octopus Server 2021.2.8084 Octopus Octopus Server 2021.2.8124 Octopus Octopus Server 2021.2.8139 Octopus Octopus Server 2021.2.8169 Octopus Octopus Server 2021.2.8189 Octopus Octopus Server 2021.2.8200 Octopus Octopus Server 2021.3.0 Octopus Octopus Server 2021.3.8275 Octopus Octopus Server 2021.3.11057 Octopus Octopus Server 2021.3.12120 Octopus Octopus Server 2021.3.12132 Octopus Octopus Server 2021.3.12313 Octopus Octopus Server 2021.3.12355 Octopus Octopus Server 2021.3.12372 Octopus Octopus Server 2021.3.12461 Octopus Octopus Server 2021.3.12533 Octopus Octopus Server 2021.3.12534 Octopus Octopus Server 2021.3.12582 Octopus Octopus Server 2021.3.12605 Octopus Octopus Server 2021.3.12646 Octopus Octopus Server 2021.3.12694 Octopus Octopus Server 2021.3.12714 Octopus Octopus Server 2021.3.12725 Octopus Octopus Server 2021.3.12768 Octopus Octopus Server 2021.3.12778 Octopus Octopus Server 2021.3.12842 Octopus Octopus Server 2021.3.12846 Octopus Octopus Server 2021.3.12856 Octopus Octopus Server 2021.3.12914 Octopus Octopus Server 2021.3.12920 Octopus Octopus Server 2021.3.12928 Octopus Octopus Server 2021.3.12944 Octopus Octopus Server 2022.1.2121 Octopus Octopus Server 2022.1.2128 Octopus Octopus Server 2022.1.2133 Octopus Octopus Server 2022.1.2232 Octopus Octopus Server 2022.1.2264 Octopus Octopus Server 2022.1.2274 Octopus Octopus Server 2022.1.2278 Octopus Octopus Server 2022.1.2300 Octopus Octopus Server 2022.1.2332 Octopus Octopus Server 2022.1.2342 Octopus Octopus Server 2022.1.2364 Octopus Octopus Server 2022.1.2386 Octopus Octopus Server 2022.1.2412 Octopus Octopus Server 2022.1.2438 Octopus Octopus Server 2022.1.2474 Octopus Octopus Server 2022.1.2488 Octopus Octopus Server 2022.1.2495 Octopus Octopus Server 2022.1.2556 Octopus Octopus Server 2022.1.2584 Octopus Octopus Server 2022.1.2637 Octopus Octopus Server 2022.1.2661 Octopus Octopus Server 2022.1.2669 Octopus Octopus Server 2022.1.2679 Octopus Octopus Server 2022.1.2733 Octopus Octopus Server 2022.1.2735 Octopus Octopus Server 2022.1.2744 Octopus Octopus Server 2022.1.2786 Octopus Octopus Server 2022.1.2803 Octopus Octopus Server 2022.1.2849 Octopus Octopus Server 2022.1.2875 Octopus Octopus Server 2022.3.348 Octopus Octopus Server 2022.3.1455 Octopus Octopus Server 2022.3.1591 Octopus Octopus Server 2022.3.2140 Octopus Octopus Server 2022.3.2387 Octopus Octopus Server 2022.2.6729 Octopus Octopus Server 2022.2.6764 Octopus Octopus Server 2022.2.6832 Octopus Octopus Server 2022.2.6849 Octopus Octopus Server 2022.2.6872 Octopus Octopus Server 2022.2.6895	130

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References