CVE-2025-0589
Last modified
CVE-2025-0589 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Octopus | Octopus Server | >= 2020.3.3, < 2024.3.13071 |
| Octopus | Octopus Server | >= 2024.4.401, < 2024.4.7065 |
References
- https://advisories.octopus.com/post/2025/sa2025-01/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-0589?
How severe is CVE-2025-0589?
How do I fix CVE-2025-0589?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0583The a+HRD from aEnrich Technology has a Reflected Cross-site…6.1
- CVE-2025-0584The a+HRD from aEnrich Technology has a Server-side Request …5.3
- CVE-2025-0585The a+HRD from aEnrich Technology has a SQL Injection vulner…9.8
- CVE-2025-0586The a+HRD from aEnrich Technology has an Insecure Deserializ…7.2
- CVE-2025-0587in OpenHarmony v5.0.2 and prior versions allow a local attac…7.8
- CVE-2025-0588In affected versions of Octopus Server it was possible for a…4.9
- CVE-2025-0590Improper permission settings for mobile applications (com.tr…7.5
- CVE-2025-0591Out-of-bounds Read vulnerability (CWE-125) was found in CX-P…7.8
- CVE-2025-0592The vulnerability may allow a remote low priviledged attacke…8.8
- CVE-2025-0593The vulnerability may allow a remote low priviledged attacke…8.8
- CVE-2025-0595A stored Cross-site Scripting (XSS) vulnerability affecting …8.7
- CVE-2025-0596A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
Are you affected by CVE-2025-0589?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST