description: In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
problem types: Insecure Direct Object Reference (IDOR)
affected:
{
product: Octopus Server
vendor: Octopus Deploy
versions:
lessThan: unspecified, status: affected, version: 2021.1.1, versionType: custom
lessThan: 2021.3.13021, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 2022.1.2121, versionType: custom
lessThan: 2022.1.2894, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 2022.2.6729, versionType: custom
lessThan: 2022.2.6971, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 2022.3.348, versionType: custom
lessThan: 2022.3.2616, status: affected, version: unspecified, versionType: custom
}