Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-0539

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably posit

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Octopus

Description

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Octopus Deploy Octopus Server

Default version status: unaffected

  • 2.6.0 to < 2024.3.13071affected
  • 2024.4.401 to < 2024.4.7065affected

References