CVE-2022-2781: Octopus Server

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.

Affected products

• Octopus Octopus Server: from 3.2.10, before 2022.1.3154 (fixed in 2022.1.3154); from 2022.2.6729, before 2022.2.7897 (fixed in 2022.2.7897); from 2022.3.348, before 2022.3.10586 (fixed in 2022.3.10586)

Published 2022-10-06. Last modified 2026-06-17.