Vulnerabilities > Octopus > Octopus Server > 2022.3.1455

DATE CVE VULNERABILITY TITLE RISK
2022-07-15 CVE-2022-1881 Authorization Bypass Through User-Controlled Key vulnerability in Octopus Server
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access.
network
low complexity
octopus CWE-639
5.3
5.3
2022-07-15 CVE-2022-29890 Cross-site Scripting vulnerability in Octopus Server
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
network
low complexity
octopus CWE-79
6.1
6.1