CVE-2022-2013 is a high-severity vulnerability affecting Octopus Server versions 2022.1.1495 through 2022.1.2647, where newly created users gained unauthorized access to the Script Console within their private spaces if the private spaces experimental feature flag was enabled. This flaw impacts Octopus Deploy installations across Linux and Windows environments. With a CVSS score of 7.5 (High), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, potentially leading to high confidentiality impact. However, there is no impact on integrity or availability. Currently, there is no evidence of active exploitation, nor is there any publicly available exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2022.1.1495, < 2022.1.2647CPE matchmatch criteria | cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:*:*:*:* | ||
< 2022.1.2647CPE match | cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.