CVE-2022-2783 : In affected versions of Octopus Server it was identified that a session cookie c

In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token

Published 2022-10-06 18:15:59

Updated 2022-11-08 19:41:14

Source Octopus Deploy

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2022-2783

Octopus » Octopus Server
Versions from including (>=) 2022.2.6729 and before (<) 2022.2.7897
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
Octopus » Octopus Server
Versions from including (>=) 3.12.0 and before (<) 2022.1.3154
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions
Octopus » Octopus Server
Versions from including (>=) 2022.3.348 and before (<) 2022.3.10586
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Assigned by: nvd@nist.gov (Primary)

https://advisories.octopus.com/post/2022/sa2022-17/

Security Advisory 2022-17 | Octopus Deploy Security Advisories
Vendor Advisory

Jump to