GitHub Advisoryadvisory · PyPI

GHSA-cc6x-8cc7-9953 OctoPrint has API key access in settings without reauthentication

MEDIUM Published 2024-11-05 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-51493
Ecosystem
PyPI
Packages
OctoPrint
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-306, CWE-620
Reviewed
2024-11-05

Affected packages

• PyPI OctoPrint: < 1.10.3 → fixed in 1.10.3

Description

Impact OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account's password. An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted. Patches The vulnerability will be patched in version 1.10.3. Credits This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

Related

Alias · CVE (1)

  • CVE-2024-51493 OctoPrint provides a web interface for controlling consumer 3D printers. vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-620 Unverified Password Change weakness

References