Login Request a demo
High severity · published Oct 14, 2022
CVE-2022-2780
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an…
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Octopus Server · Octopus Deploy
2021.2.994 before unspecified; before 2022.1.3180; 2022.2.6729 before unspecified; before 2022.2.7965; 2022.3.348 before unspecified; before 2022.3.10586 · source: vendor, NVD
Affected product
OS
Octopus Server
Octopus Deploy
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2780
Vendor Advisory
https://advisories.octopus.com/post/2022/sa2022-20/
More from Octopus Server
9.8
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still…
9.8
CVE-2022-2778
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes
9.1
CVE-2026-0704
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint
9.1
CVE-2022-2782
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters
8.7
CVE-2026-116870
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently