CVE-2022-2822

2022-08-1511:21:32

CWE-307

@huntrdev

web.nvd.nist.gov

cve-2022-2822

brute force

account takeover

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

51.0%

JSON

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.

Affected configurations

Nvd

Node

octoprintoctoprintRange<1.9.0

VendorProductVersionCPE
octoprintoctoprint*cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
octoprint	octoprint	*	cpe:2.3:a:octoprint:octoprint::::::::

CNA Affected

[
  {
    "product": "octoprint/octoprint",
    "vendor": "octoprint",
    "versions": [
      {
        "lessThan": "1.9.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]