Information Disclosure Vulnerability in Octopus Server by Octopus Deploy
CVE-2025-0525

2.3LOW

Key Information:

Vendor: Octopus Deploy
Status: Octopus Server
Vendor: CVE Published:; 11 February 2025

🔔 Create Octopus Deploy Vulnerability Alert

What is CVE-2025-0525?

In certain versions of Octopus Server, a flaw in the preview import feature can be exploited by an attacker to ascertain the existence of specific target files. This information could potentially be utilized to facilitate more targeted and effective attacks on the server, compromising its security posture and exposing sensitive data.

Affected Version(s)

Octopus Server Windows 2020.6.4592 < 2024.3.13007

Octopus Server Windows 2024.4.401 < 2024.4.6995

References

https://advisories.octopus.com/post/2024/sa2025-02/

CVSS V4

Score:

2.3

Severity:

LOW

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Feb 11, 2025
Vulnerability Reserved
Jan 17, 2025

Credit

This vulnerability was found by Edward Prior (@JankhJankh)