TI-2025-00492 Aliases CVE-2025-0588 GHSA-8w92-pvrp-jcwv

HTTP response splitting in Octopus Server

LOW 27CWE-113Published 2025-02-11 · Updated 2025-03-13

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00423 36th percentileScored 2026-11-07

Fix Fixed Octopus Server (Octopus Deploy): 2024.3.13097, 2024.4.7091

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Octopus Deploy	Octopus Server	2020.1.0 to before 2024.3.13097; 2024.4.401 to before 2024.4.7091	2024.3.13097, 2024.4.7091	Patch available	CNA

Octopus Server VendorOctopus Deploy Affected 2020.1.0 to before 2024.3.13097; 2024.4.401 to before 2024.4.7091 Fixed in 2024.3.13097, 2024.4.7091 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:octopus:octopus_server::::::::	2020.1.0 to before 2024.3.13097; 2024.4.401 to before 2024.4.7091	Vulnerable	Octopus Deploy
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* Versions 2020.1.0 to before 2024.3.13097; 2024.4.401 to before 2024.4.7091 Vulnerable ·Octopus Deploy
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Octopus Server (Octopus Deploy) Fixed in 2024.3.13097, 2024.4.7091

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-02-11
Octopus Server 2024.3.13097, 2024.4.7091
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-00436 Missing authorization in Octopus ServerPriority LOW 18
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-0588
2026-10-03 Alias added: GHSA-8w92-pvrp-jcwv

References

Advisory 1

https://advisories.octopus.com/post/2025/sa2025-05/

Other 1

https://advisories.octopus.com/post/2024/sa2025-05/

TI-2018-13353 In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with… CVSS 3.0HIGH 8.8
TI-2022-02375 Improper authentication in Octopus Server CVSS 3.1CRITICAL 9.8
TI-2022-02579 Insufficient session expiration in Octopus Server CVSS 3.1CRITICAL 9.1
TI-2018-08066 In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the… CVSS 3.0CRITICAL 9.8
TI-2022-02575 In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. CVSS 3.1CRITICAL 9.8
TI-2022-03678 In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation CVSS 3.1HIGH 8.8

See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences