medium5.3
CVE-2022-1881
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports fro…
Impact
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Octopus Server | from 2021.1.6959 before 2021.3.13021 from 2022.1.2121 before 2022.1.2894 from 2022.2.6729 before 2022.2.6971 from 2022.3.348 before 2022.3.2616 |