CVE-2025-0525
Published: 11 February 2025
Summary
CVE-2025-0525 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Octopus Octopus Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked at the 47.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AU-13 (Monitoring for Information Disclosure).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring identification, reporting, and timely remediation of the information disclosure flaw in the preview import feature.
Prohibits unauthenticated access to features like preview import that could disclose file existence information.
Monitors for unauthorized disclosures such as those enabled by the preview import feature's file existence oracle.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables remote file existence checks on the server via the preview import feature, mapping to File and Directory Discovery.
NVD Description
In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversary with information that may aid in further attacks against the server.
Deeper analysisAI
CVE-2025-0525 is an information disclosure vulnerability in affected versions of Octopus Server, where the preview import feature can be abused to detect the existence of a target file on the server. This issue, classified under CWE-200, enables adversaries to gather sensitive reconnaissance data. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2025-02-11T10:15:09.490.
Unauthenticated attackers with network access to the Octopus Server can exploit this vulnerability remotely with low complexity and no user interaction. Exploitation confirms the presence or absence of specific files, yielding information that may assist in planning further attacks against the server, though it does not directly enable data modification, execution, or denial of service.
The official advisory provides details on mitigation and patching; refer to https://advisories.octopus.com/post/2024/sa2025-02/ for affected versions, patch information, and recommended actions.
Details
- CWE(s)