What’s Vulnerable › Vulnerabilities

CVE-2022-23184

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-07 · updated 2026-06-17
• Weakness: CWE-601

Description

In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.

Affected products

• Octopus Deploy: from 0.9 through 4.1.10; from 2018.1.0 through 2020.1.1
• Octopus Deploy Octopus Server: from 2021.2.0 before 2021.2.8011; from 2021.3.0 before 2021.3.11057 — fixed in 2021.2.8011, 2021.3.11057

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2021.2.8011, 2021.3.11057. Check the vendor advisory for mitigations.

References

• https://advisories.octopus.com/post/2022/sa2022-02/
• https://advisories.octopus.com/post/2022/sa2022-02/

Get alerted when CVE-2022-23184 or the next vulnerability affects your stack