CVE-2025-0588

Medium

Description

In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.

SeverityMedium

CVSS4.9

Exploit probability—

ProductOctopus Server

PublishedFeb 11, 2025

First seenFeb 11, 2025

Weakness typeCWE-113CWE-113

How to fix

Update

octopus octopus_server2024.3.13097, 2024.4.7091 or later

Vendor advisories

advisories.octopus.com/post/2025/sa2025-05/

Affected products

Product	Affected versions	Fixed in
octopus octopus_server	2020.1.0 ≤ v < 2024.3.13097, 2024.4.401 ≤ v < 2024.4.7091	2024.3.13097, 2024.4.7091

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.