5.4
CVE-2025-0526
- EPSS 0.32%
- Veröffentlicht 11.02.2025 11:15:15
- Zuletzt bearbeitet 02.07.2025 17:23:30
- Quelle security@octopus.com
- CVE-Watchlists
- Unerledigt
In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Octopus ≫ Octopus Server Version >= 2022.4.791 < 2024.3.13097
Octopus ≫ Octopus Server Version >= 2024.4.401 < 2024.4.7091
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.32% | 0.238 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
|
| security@octopus.com | 2.3 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
https://advisories.octopus.com/post/2024/sa2025-03/
https://advisories.octopus.com/post/2025/sa2025-03/