{"cve":"CVE-2025-0588","nvd":{"published":"2025-02-11T12:15:34.200","modified":"2026-06-17T08:26:46.140","status":"Analyzed","description":"In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":5.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":4.9},"cwes":["CWE-113"],"references":["https://advisories.octopus.com/post/2024/sa2025-05/","https://advisories.octopus.com/post/2024/sa2025-05/","https://advisories.octopus.com/post/2025/sa2025-05/"],"products":["octopus:octopus_server"],"source":"nvd","synced_at":"2026-10-19T21:59:18.731010617+00:00"},"epss":{"cve":"CVE-2025-0588","score":0.00423,"percentile":0.36615,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}