Skip to content
OpenAdvisories
High · 8.8 CVE-2022-4009 EUVD-2022-51390GHSA-fjgj-7xgj-vmh7

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation

Published Mar 16, 2023 · Updated Feb 26, 2025 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Server

Description

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation

Affected products

VendorProductAffectedFixed
Octopus Deploy Octopus Server 3.0.19 – < unspecified, unspecified – < 2022.2.8552, 2022.3.348 – < unspecified, unspecified – < 2022.3.10750, 2022.4.791 – < unspecified, unspecified – < 2022.4.8319, unspecified – < 2023.1.4189 unspecified

Advisories 1

References