CVE-2022-3614
03.01.2023, 02:15
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.
| Vendor | Product | Version |
|---|---|---|
| octopus | octopus_server | 3.5 ≤ 𝑥 < 2022.3.10750 |
| octopus | octopus_server | 2022.4 ≤ 𝑥 < 2022.4.8063 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
- CWE-288 - Authentication Bypass Using an Alternate Path or ChannelA product requires authentication, but the product has an alternate path or channel that does not require authentication.