CVE-2025-0539 MEDIUM

CVE-2025-0539

Vendor Octopus Deploy
Product Octopus Server
Published April 10, 2025
Last update April 15, 2025

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself.

Key dates

02Disclosure timeline

April 10, 2025 CVE published
April 15, 2025 Record updated