CVE-2022-29890: Octopus Server

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.

Affected products

• Octopus Octopus Server: from 2019.7.0, before 2021.3.13021 (fixed in 2021.3.13021); from 2022.1.2121, before 2022.1.2849 (fixed in 2022.1.2849); from 2022.3.348, before 2022.3.2387 (fixed in 2022.3.2387); version 2022.2.6729 only

Published 2022-07-15. Last modified 2026-06-17.