Login Request a demo
Medium severity · published Feb 11, 2025
CVE-2025-0588
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Octopus Server · Octopus Deploy
2020.1.0 before 2024.3.13097; 2024.4.401 before 2024.4.7091 · source: vendor, NVD
Affected product
OS
Octopus Server
Octopus Deploy
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0588
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0588
Broken Link
https://advisories.octopus.com/post/2024/sa2025-05/
Vendor Advisory
https://advisories.octopus.com/post/2025/sa2025-05/
More from Octopus Server
9.8
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still…
9.8
CVE-2022-2778
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes
9.1
CVE-2026-0704
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint
9.1
CVE-2022-2782
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters
8.8
CVE-2025-0539
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably…