CVE-2022-1502

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-04 · updated 2026-06-17

Description

Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.

Affected products

Octopus Server: from 2021.3 before 2021.3.12725; from 2022.1 before 2022.1.2454 — fixed in 2021.3.12725, 2022.1.2454

How to fix

Upgrade to a fixed version: Octopus Server 2021.3.12725, 2022.1.2454. Check the vendor advisory for mitigations.

References

https://advisories.octopus.com/post/2022/sa2022-03/
https://advisories.octopus.com/post/2022/sa2022-03/

Get alerted when CVE-2022-1502 or the next vulnerability affects your stack