CVE-2022-2528

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-25297.5sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malforCVE-2022-252906.5WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private kCVE-2022-252918.8An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflowCVE-2022-252928.8A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially executCVE-2022-252938.8A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially executCVE-2022-252947.8Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local WiCVE-2022-252955.4This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The aCVE-2022-252967.3The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifyinCVE-2022-252978.8This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method CVE-2022-252987.5This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server.CVE-2022-252997.5This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enabCVE-2022-253019.8All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, inc
CVE-2022-2528: Medium severity, CVSS 6.5 | Vulnix