high7.5
CVE-2022-1670
When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users.
Impact
When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Octopus Server | from 0.9 before 2021.3.12533 from 2022.1.0 before 2022.1.53 |