{"affected":[{"affectedData":[{"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"unspecified","status":"affected","version":"0.9","versionType":"custom"},{"lessThan":"2021.3.12533","status":"affected","version":"unspecified","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"2022.1.0","versionType":"custom"},{"lessThan":"2022.1.53","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@octopus.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*","matchCriteriaId":"A1F82F5F-A24D-4611-83F4-BFE131FDD51E","versionEndExcluding":"2021.3.12533","versionStartIncluding":"0.9","vulnerable":true},{"criteria":"cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*","matchCriteriaId":"BE23BD46-4EC3-46C7-B890-0C44BA0F2DEB","versionEndExcluding":"2022.1.53","versionStartIncluding":"2022.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users."},{"lang":"es","value":"Cuando es generado un código de invitación de usuario en Octopus Server, la comprobación de este código puede establecerse para un número específico de usuarios. Era posible omitir esta restricción de comprobación para crear cuentas de usuario adicionales por encima del número inicial de usuarios invitados"}],"id":"CVE-2022-1670","lastModified":"2026-06-17T04:22:53.930","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-05-19T05:15:07.010","references":[{"source":"security@octopus.com","tags":["Vendor Advisory"],"url":"https://advisories.octopus.com/post/2022/sa2022-04/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://advisories.octopus.com/post/2022/sa2022-04/"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}