In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
References
| Link | Resource |
|---|---|
| https://advisories.octopus.com/post/2025/sa2025-01/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
02 Jul 2025, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://advisories.octopus.com/post/2025/sa2025-01/ - Vendor Advisory | |
| CPE | cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| First Time |
Octopus
Linux Microsoft windows Octopus octopus Server Microsoft Linux linux Kernel |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
11 Feb 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-11 09:15
Updated : 2025-07-02 17:25
NVD link : CVE-2025-0589
Mitre link : CVE-2025-0589
JSON object : View
Products Affected
linux
- linux_kernel
microsoft
- windows
octopus
- octopus_server
CWE
No CWE.