CVE-2025-0513: 
Octopus Deploy vulnerability analysis and mitigation

In affected versions of Octopus Server, a vulnerability was discovered related to unsafe handling of error messages on the error page. The vulnerability was assigned CVE-2025-0513 and was disclosed on February 11, 2025. The vulnerability affects Octopus Server installations and is classified as a Cross-site Scripting (XSS) vulnerability (NVD).

The vulnerability is characterized by improper neutralization of input during web page generation, specifically in the error page functionality. It has been assigned CWE-79 (Cross-site Scripting). The CVSS v4.0 score is 1.8 (LOW) with the vector string CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, indicating a low-severity vulnerability requiring high attack complexity and high privileges (NVD).

If an adversary could control any part of the error message, they could potentially embed malicious code which may impact users viewing the error message. The vulnerability has low severity ratings for Confidentiality (VC:L), Integrity (VI:L), and Availability (VA:L) impacts (NVD).

The vulnerability requires network access (AV:N), high attack complexity (AC:H), high privileges (PR:H), and user interaction (UI:A) for exploitation. The attack requires a privileged attacker to manipulate error messages that would then be viewed by other users (NVD).