CVE-2025-0589
- State
- Published
- Severity
- 6.9 Medium
- Published
- Feb 11, 2025
- Updated
- Feb 11, 2025
- Reserved
- Jan 20, 2025
Description
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N | Octopus |
Weaknesses
- CWE-648 Incorrect Use of Privileged APIs
Affected Products
| Product | Versions |
|---|---|
Octopus ServerOctopus Deploy |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.