CVE-2022-4898: Octopus Server

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS

Affected products

• Octopus Octopus Server: from 2019.7.0, before 2022.2.8552 (fixed in 2022.2.8552); from 2022.3.348, before 2022.3.10750 (fixed in 2022.3.10750); from 2022.4.791, before 2022.4.8319 (fixed in 2022.4.8319)

Published 2023-01-31. Last modified 2026-06-17.