CVE-2022-2720: Octopus Server

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work.

Affected products

• Octopus Octopus Server: from 3.16.4, before 2022.1.3154 (fixed in 2022.1.3154); from 2022.2.6729, before 2022.2.7934 (fixed in 2022.2.7934); from 2022.3.348, before 2022.3.10586 (fixed in 2022.3.10586)

Published 2022-10-12. Last modified 2026-06-17.