CVE-2025-0589
First published: Tue Feb 11 2025(Updated: )
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
Credit: security@octopus.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Octopus Deploy |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0589?
CVE-2025-0589 is considered a high-severity vulnerability due to its potential for data exposure.
How do I fix CVE-2025-0589?
To fix CVE-2025-0589, ensure that you update to the latest version of Octopus Deploy that addresses this vulnerability.
Which versions of Octopus Deploy are affected by CVE-2025-0589?
CVE-2025-0589 affects specific versions of Octopus Deploy that utilize Active Directory for authentication.
Can CVE-2025-0589 be exploited remotely?
Yes, CVE-2025-0589 can be exploited remotely as it allows unauthenticated users to make API requests.
What data can be exposed due to CVE-2025-0589?
CVE-2025-0589 could potentially expose sensitive data from the associated Active Directory.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- agent/author
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/weakness
- agent/event
- vendor/octopus deploy
- canonical/octopus deploy