CVE-2022-3460

In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when…

High7.5EPSS 0.60%

Published: 2 Jan 2023
Updated: 10 Apr 2025
Reserved: 11 Oct 2022
Assigned by: Octopus

Description

In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.

Scores

CVSS scores of CVE-2022-3460, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.60% · top 51% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Exposure of Sensitive Information Through Environmental Variables
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
CWE-212 (opens in a new tab)All about CWE-212 and its CVEs

Affected products

Octopus Deploy · Octopus Server
- affected 2018.3.1 – < unspecified
- affected unspecified – < 2021.3.13150
- affected 2022.1.2121 – < unspecified
- affected unspecified – < 2022.1.3281
- affected 2022.2.7897 – < unspecified
- affected unspecified – < 2022.2.8552
- affected 2022.3.348 – < unspecified
- affected unspecified – < 2022.3.10750
- affected 2022.4.791 – < unspecified
- affected unspecified – < 2022.4.8221

References (1)

https://advisories.octopus.com/post/2022/sa2022-25/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-3460](https://trackcve.app/badge/CVE-2022-3460.svg)](https://trackcve.app/cve/CVE-2022-3460)

Record last updated 10 Apr 2025, 15:25 UTC.