GitHub Advisoryadvisory · PyPI

GHSA-5626-pw9c-hmjr OctoPrint Unverified Password Change via Access Control Settings

MEDIUM Published 2024-01-31 Modified 2024-02-08 Official page ↗
Aliases
CVE-2024-23637
Ecosystem
PyPI
Packages
OctoPrint
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-287, CWE-620
Reviewed
2024-01-31

Affected packages

• PyPI OctoPrint: < 1.10.0rc1 → fixed in 1.10.0rc1

Description

Impact OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. Patches The vulnerability will be patched in version 1.10.0. Workarounds OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation. Credits This vulnerability was discovered and responsibly disclosed to OctoPrint by Timothy "TK" Ruppert.

Related

Alias · CVE (1)

  • CVE-2024-23637 OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-620 Unverified Password Change weakness

References