CVE-2024-23637

    Dashboard / Vulnerabilities / CVE-2024-23637

    CVE-2024-23637

    Published: 31 Jan 2024Last Modified: 28 Oct 2026

    Summary: OctoPrint Unverified Password Change via Access Control Settings

    Details: OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

    References: https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23637.json, https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr, https://nvd.nist.gov/vuln/detail/CVE-2024-23637, https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1729d167b4ae4a5835bbc7211b92c6828b1c4125

    Affected versions

    1.9.0rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23637 | CVE-DB