Description
In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.
Metrics
CVSS 3.1 6.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Octopus Deploy | Octopus Server | >= unspecified, < 2021.2.8011; >= unspecified, < 2021.3.11057 |
References
- https://advisories.octopus.com/post/2022/sa2022-02/Mitigation, Vendor Advisory
- https://advisories.octopus.com/post/2022/sa2022-02/Mitigation, Vendor Advisory
Timeline
- Published
- Feb 7, 2022
- Last modified
- Jun 17, 2026
- NVD status
- Modified