Description
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2021.1.1 – < unspecified, unspecified – < 2021.3.13021, 2022.1.2121 – < unspecified, unspecified – < 2022.1.2894, 2022.2.6729 – < unspecified, unspecified – < 2022.2.6971, 2022.3.348 – < unspecified, unspecified – < 2022.3.2616 | unspecified |