CVEvulnerability

CVE-2022-2780

8.1 HIGH Published 2022-10-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-294

Description

In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.

Affected configurations

• octopus octopus server (>= 2021.2.994 < 2022.1.3180) • octopus octopus server (>= 2022.2.6729 < 2022.2.7965) • octopus octopus server (>= 2022.3.348 < 2022.3.10586)

Related

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References