CVE-2022-2259

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-13 · updated 2026-06-17
Weakness: CWE-284

Description

In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items

Affected products

Octopus Deploy Octopus Server: from 2019.1.0 before 2022.3.11098; from 2022.4.791 before 2022.4.8463; from 2023.1.4189 before 2023.1.9672; 2023.2.2028 — fixed in 2022.3.11098, 2022.4.8463, 2023.1.9672

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2022.3.11098, 2022.4.8463, 2023.1.9672. Check the vendor advisory for mitigations.

References

https://advisories.octopus.com/post/2023/sa2023-04/
https://advisories.octopus.com/post/2023/sa2023-04/

Get alerted when CVE-2022-2259 or the next vulnerability affects your stack