CVE-2024-23637

2024-01-3118:15:49

CWE-620

CWE-287

GitHub_M

web.nvd.nist.gov

octoprint

3d printer

web interface

cve-2024-23637

vulnerability

security

patch

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

19.1%

JSON

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

Affected configurations

Nvd

Vulners

Node

octoprintoctoprintRange≤1.9.3

VendorProductVersionCPE
octoprintoctoprint*cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
octoprint	octoprint	*	cpe:2.3:a:octoprint:octoprint::::::::

CNA Affected

[
  {
    "vendor": "OctoPrint",
    "product": "OctoPrint",
    "versions": [
      {
        "version": "< 1.10.0rc1",
        "status": "affected"
      }
    ]
  }
]