Vulnerability · Published Feb 11, 2025 · Assigned by Octopus
CVE-2025-0588
Medium 5.9
In plain English
A medium-severity security flaw in Octopus Server from Octopus Deploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Octopus Deploy | Octopus Server | 2020.1.0 – before 2024.3.130972024.4.401 – before 2024.4.7091 |
Weakness: CWE-113 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N