Vulnerability · Published Jan 31, 2024 · Assigned by GitHub_M
CVE-2024-23637OctoPrint Unverified Password Change via Access Control Settings
Medium 4.2
In plain English
A medium-severity improper authentication in OctoPrint from OctoPrint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | octoprint | 1.10.0rc1 | GHSA-5626-pw9c-hmjr |
| PyPI | octoprint | 1.10.0rc1 | PYSEC-2024-29 |
Affected products (as reported)
Weakness: CWE-287, CWE-620 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L