In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://advisories.octopus.com/post/2025/sa2025-01/ |
Configurations
No configuration.
History
11 Feb 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-648 |
11 Feb 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-11 09:15
Updated : 2025-02-11 16:15
NVD link : CVE-2025-0589
Mitre link : CVE-2025-0589
CVE.ORG link : CVE-2025-0589
JSON object : View
Products Affected
No product.
CWE
CWE-648
Incorrect Use of Privileged APIs