Vulnerability · Published Jan 31, 2023 · Assigned by Octopus

CVE-2022-4898

Medium 5.4

In plain English

A medium-severity cross-site scripting in Octopus Server from Octopus Deploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS

Affected products (as reported)

Vendor	Product	Versions
Octopus Deploy	Octopus Server	2019.7.0 – before unspecifiedunspecified – before 2022.2.85522022.3.348 – before unspecifiedunspecified – before 2022.3.107502022.4.791 – before unspecifiedunspecified – before 2022.4.8319

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://advisories.octopus.com/post/2022/sa2023-01/