CVE-2022-4898

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Octopus DeployOctopus Server>= 2019.7.0, < unspecified; >= unspecified, < 2022.2.8552; >= 2022.3.348, < unspecified; >= unspecified, < 2022.3.10750; >= 2022.4.791, < unspecified; >= unspecified, < 2022.4.8319

References

Timeline

Published
Jan 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-489807.8In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policiCVE-2022-489817.8In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap()CVE-2022-489825.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fakCVE-2022-489835.5In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Syzkaller reports CVE-2022-489845.5In the Linux kernel, the following vulnerability has been resolved: can: slcan: fix freed work crash The LTP test pty03 is causing a crashCVE-2022-489854.7In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix race on per-CQ variable napi work_done After calling naCVE-2022-489865.5In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns trCVE-2022-489875.5In the Linux kernel, the following vulnerability has been resolved: media: v4l2-dv-timings.c: fix too strict blanking sanity checks SanityCVE-2022-489887.0In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcCVE-2022-489894.7In the Linux kernel, the following vulnerability has been resolved: fscache: Fix oops due to race with cookie_lru and use_cookie If a cookCVE-2022-48997.5A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause bufferCVE-2022-489907.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free during gpu recovery [Why] [ 754.86
CVE-2022-4898: Medium severity, CVSS 5.4 | Vulnix