CVE-2022-2781

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Oct 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-278107.5It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.CVE-2022-278119.8GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.CVE-2022-278127.5Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific forged traffic, can leaCVE-2022-278138.2Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoCVE-2022-278143.3SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.CVE-2022-278157.8SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.CVE-2022-278167.1SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.CVE-2022-278174.4SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of fCVE-2022-278189.1SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.CVE-2022-278195.3SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustCVE-2022-27829.1In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the sessionCVE-2022-278204.0OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.