CVE-2025-0513

State: Published
Severity: 1.8 Low
Published: Feb 11, 2025
Updated: Feb 11, 2025
Reserved: Jan 16, 2025

Description

In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they could embed code which may impact the user viewing the error message.

Scores

CVSS	Score	Vector	Source
4.0	1.8 Low	CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	Octopus

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Octopus ServerOctopus Deploy	2024.3.164 to before 2024.3.12985Affected 2024.4.401 to before 2024.4.6962Affected

References

https://advisories.octopus.com/post/2024/sa2025-04/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.