CVE-2022-2346

Summary

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.

Affected Software

VendorProductVersion RangeStatus
Octopus DeployOctopus Server2019.4.0 < 2022.4.9997affected
Octopus DeployOctopus Server2023.1.0 < 2023.1.10235affected
Octopus DeployOctopus Server2023.2.0 < 2023.2.10545affected

Weaknesses

  • Guest user with low permissions able to interact with extension endpoints

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References