CVE-2025-0513: In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they…

PriorityP423medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.22%

13.0th percentile

In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they could embed code which may impact the user viewing the error message.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
octopus	octopus_server	>= 2024.3.164 < 2024.3.12985	2024.3.12985
octopus	octopus_server	>= 2024.4.401 < 2024.4.6962	2024.4.6962
octopus_deploy	octopus_server	>= 2024.3.164 < 2024.3.12985	2024.3.12985
octopus_deploy	octopus_server	>= 2024.4.401 < 2024.4.6962	2024.4.6962

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv4.01.8LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.