Total vulnerabilities in the database
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
| Software | From | Fixed in |
|---|---|---|
| octopus / octopus_server | 2022.3.348 | 2022.3.10586 |
| octopus / octopus_server | 3.5 | 2022.1.3264 |
| octopus / octopus_server | 2022.4.791 | 2022.4.2898 |
| octopus / octopus_server | 2022.2.6729 | 2022.2.8277 |