CVE-2025-0589

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-648

Affected software

Vendor	Product	Versions
Octopus Deploy	Octopus Server	>= 2020.3.3, < 2024.3.13071; >= 2024.4.401, < 2024.4.7065

References

https://advisories.octopus.com/post/2025/sa2025-01/Vendor Advisory

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-05907.5Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-05917.8Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an appli CVE-2025-05928.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploadin CVE-2025-05938.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact wit CVE-2025-05958.7A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPER CVE-2025-05965.4A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIEN CVE-2025-05985.4A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R CVE-2025-05995.4A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPE CVE-2025-06005.4A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIE CVE-2025-06015.4A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPER CVE-2025-06028.7A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x thr CVE-2025-06039.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emerg