high8.8
CVE-2025-0539
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allo…
Impact
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Octopus Server | from 2.6.0 before 2024.3.13071 from 2024.4.401 before 2024.4.7065 |