GitHub Advisoryadvisory · PyPI

GHSA-5w5x-q9p5-9qg3 OctoPrint does not have rate limiting on the login page

LOW Published 2022-08-16 Modified 2023-09-01 Official page ↗
Aliases
CVE-2022-2822
Ecosystem
PyPI
Packages
OctoPrint
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-307
Reviewed
2022-08-18

Affected packages

• PyPI OctoPrint: <= 1.7.3 (no fix yet)

Description

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The `devel` and `maintenance` branches of the repository have a fix that limits the rate of failed login attempts.

Related

Alias · CVE (1)

  • CVE-2022-2822 An attacker can freely brute force username and password and can takeover any account. vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References