CVE-2022-2822 Authentication Bypass by Primary Weakness in octoprint/octoprint

2022-08-1510:30:17

CWE-307

@huntrdev

www.cve.org

cve-2022-2822

brute force

password guessing

administrative accounts

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

51.0%

JSON

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.

CNA Affected

[
  {
    "product": "octoprint/octoprint",
    "vendor": "octoprint",
    "versions": [
      {
        "lessThan": "1.9.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]