CVE-2022-1881

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-15 · updated 2026-06-17
Weakness: CWE-639

Description

In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.

Affected products

Octopus Deploy Octopus Server: from 2021.1.6959 before 2021.3.13021; from 2022.1.2121 before 2022.1.2894; from 2022.2.6729 before 2022.2.6971; from 2022.3.348 before 2022.3.2616 — fixed in 2021.3.13021, 2022.1.2894, 2022.2.6971, 2022.3.2616

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2021.3.13021, 2022.1.2894, 2022.2.6971, 2022.3.2616. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-1881 or the next vulnerability affects your stack