PYSEC-2024-29

    Dashboard / Vulnerabilities / PYSEC-2024-29

    PYSEC-2024-29

    Published: 31 Jan 2024Last Modified: 8 Feb 2024

    Summary:

    Details: OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

    References: https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr, https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125, https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1

    Affected packages

    Package

    Name: octoprint

    Purl: pkg:pypi/octoprint

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1729d167b4ae4a5835bbc7211b92c6828b1c4125

    Affected versions

    1.3.11
    1.3.12
    1.3.12rc1
    1.3.12rc3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2024-29 | CVE-DB