GitHub Advisoryadvisory · PyPI

GHSA-39gf-864w-pxw4 Unverified Password Change in OctoPrint

MEDIUM Published 2022-08-23 Modified 2024-11-22 Official page ↗
Aliases
CVE-2022-2930
Ecosystem
PyPI
Packages
OctoPrint
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-620
Reviewed
2022-08-30

Affected packages

• PyPI OctoPrint: < 1.8.3 → fixed in 1.8.3

Description

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.

Related

Alias · CVE (1)

  • CVE-2022-2930 Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3. vulnerability

Weakness · CWE (1)

  • CWE-620 Unverified Password Change weakness

References