Read the docs
TI-2022-02578 Aliases CVE-2022-2781GHSA-xppm-x368-2qjm

Broken or risky cryptographic algorithm in Octopus Server

Priority LOW 23CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.

Summary

In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.

Why it matters now

EPSS 0.00228 13th percentileScored 2026-11-07
Fix Fixed Octopus Server (Octopus Deploy): 2022.1.3154, 2022.2.7897, 2022.3.10586

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Octopus DeployOctopus Server3.2.10 and later; before 2022.1.3154; 2022.2.6729 and later; before 2022.2.7897; 2022.3.348 and later; before 2022.3.105862022.1.3154, 2022.2.7897, 2022.3.10586Patch availableCNA
  • Octopus Server VendorOctopus Deploy Affected 3.2.10 and later; before 2022.1.3154; 2022.2.6729 and later; before 2022.2.7897; 2022.3.348 and later; before 2022.3.10586 Fixed in 2022.1.3154, 2022.2.7897, 2022.3.10586 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*3.2.10 to before 2022.1.3154; 2022.2.6729 to before 2022.2.7897; 2022.3.348 to before 2022.3.10586VulnerableOctopus Deploy
  • cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* Versions 3.2.10 to before 2022.1.3154; 2022.2.6729 to before 2022.2.7897; 2022.3.348 to before 2022.3.10586 Vulnerable ·Octopus Deploy

Remediation

  • Fix · CNA Octopus Server (Octopus Deploy) Fixed in 2022.1.3154, 2022.2.7897, 2022.3.10586

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Octopus Server 2022.1.3154, 2022.2.7897 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-02580 In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF tokenPriority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2781
  2. 2026-10-03 Alias added: GHSA-xppm-x368-2qjm

References

Advisory 1

  • TI-2018-13353 In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with… CVSS 3.0HIGH 8.8
  • TI-2022-02375 Improper authentication in Octopus Server CVSS 3.1CRITICAL 9.8
  • TI-2022-02579 Insufficient session expiration in Octopus Server CVSS 3.1CRITICAL 9.1
  • TI-2018-08066 In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the… CVSS 3.0CRITICAL 9.8
  • TI-2022-02575 In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. CVSS 3.1CRITICAL 9.8
  • TI-2022-03678 In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation CVSS 3.1HIGH 8.8
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences