Vulnerability · Published Feb 11, 2025 · Assigned by Octopus
CVE-2025-0589
Medium 6.9
In plain English
A medium-severity security flaw in Octopus Server from Octopus Deploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Octopus Deploy | Octopus Server | 2020.3.3 – before 2024.3.130712024.4.401 – before 2024.4.7065 |
Weakness: CWE-648 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N