CVE-2022-1502

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Octopus Deploy	Octopus Server	<

References

https://advisories.octopus.com/post/2022/sa2022-03/Patch, Vendor Advisory
https://advisories.octopus.com/post/2022/sa2022-03/Patch, Vendor Advisory

Timeline

Published: May 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-15035.4A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of CVE-2022-15046.1XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.CVE-2022-15057.5The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user s CVE-2022-15065.4The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low CVE-2022-15075.5chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash CVE-2022-15086.1An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some speci CVE-2022-15098.8Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges CVE-2022-15107.5An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.CVE-2022-15116.5Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.CVE-2022-15124.8The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users t CVE-2022-15138.8A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specia CVE-2022-15145.4Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scriptin