CVE-2022-1901 : In affected versions of Octopus Deploy it is possible to unmask sensitive variab

In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.

Published 2022-08-19 08:15:07

Updated 2022-08-20 02:33:35

Source Octopus Deploy

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2022-1901

Octopus » Octopus Server
Versions from including (>=) 2019.1.0 and up to, including, (<=) 2019.7.3
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Octopus » Octopus Server
Versions from including (>=) 2021.1.6959 and up to, including, (<=) 2021.3.13021
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Octopus » Octopus Server
Versions from including (>=) 2022.1.0 and before (<) 2022.1.3009
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Octopus » Octopus Server
Versions from including (>=) 2020.1.0 and up to, including, (<=) 2020.6.5449
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Octopus » Octopus Server
Versions from including (>=) 2022.3.348 and before (<) 2022.3.4953
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Octopus » Octopus Server
Versions from including (>=) 2022.2.6729 and before (<) 2022.2.7244
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-1901

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-1901

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2022-1901

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-1901

https://advisories.octopus.com/post/2022/sa2022-09/

Security Advisory 2022-09 | Octopus Deploy Security Advisories
Mitigation;Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-1901

Products affected by CVE-2022-1901

Exploit prediction scoring system (EPSS) score for CVE-2022-1901

CVSS scores for CVE-2022-1901

CWE ids for CVE-2022-1901

References for CVE-2022-1901