Incorrect Default Permissions

CVE-2022-2528

Medium

6.5/10

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.

During installation, installed file permissions are set to allow anyone to modify those files.