CVE-2022-2888 Insufficient Session Expiration in octoprint/octoprint

2022-09-2111:25:08

CWE-613

@huntrdev

www.cve.org

cve-2022-2888

octoprint

session expiration

unauthorized access

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

Percentile

12.8%

JSON

If an attacker comes into the possession of a victim’s OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim’s account exists.

CNA Affected

[
  {
    "product": "octoprint/octoprint",
    "vendor": "octoprint",
    "versions": [
      {
        "lessThan": "1.8.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]