Description
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2.6.0 – < 2024.3.13071, 2024.4.401 – < 2024.4.7065 | 2024.3.13071 |
Advisories 1
- WID-SEC-2025-0631 Octopus Deploy: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Mar 24, 2025