CVE-2025-0589: In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API…

PriorityP431medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.34%

26.1th percentile

In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
octopus	octopus_server	>= 2020.3.3 < 2024.3.13071	2024.3.13071
octopus	octopus_server	>= 2024.4.401 < 2024.4.7065	2024.4.7065
octopus_deploy	octopus_server	>= 2020.3.3 < 2024.3.13071	2024.3.13071
octopus_deploy	octopus_server	>= 2024.4.401 < 2024.4.7065	2024.4.7065

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.