CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-32977

creationtimestamp| type| source ---|---|--- 2024-05-14 09:53:56+00:00| published-proof-of-concept| https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7...

OctoPrint 安全漏洞

OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint versions prior to 1.10.0 that stems from the presence of an authentication bypass...

PT-2024-25024 · Octoprint · Octoprint

Name of the Vulnerable Software and Affected Versions: OctoPrint versions up to and including 1.10.0 Description: OctoPrint provides a web interface for controlling consumer 3D printers. The issue allows an unauthenticated attacker to bypass authentication if the autologinLocal option is enabled...

Cross-Site Scripting (XSS)

octoprint is vulnerable to Cross-Site Scripting XSS. The vulnerability due to improper input validation and sanitization of the webcam snapshot URL input field, which allows for the execution of malicious JavaScript code into the victim's browser...

PYSEC-2024-179

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

CVE-2024-28237

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

PYSEC-2024-179

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

CVE-2024-28237 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

CVE-2024-28237

The CVE-2024-28237 issue affects OctoPrint prior to 1.10.0rc3, specifically the Classic Webcam plugin snapshot URL feature. The root cause is a cross-site scripting (XSS) vulnerability where a crafted webcam snapshot URL tested via the web interface can cause JavaScript to execute in a victim adm...

CVE-2024-28237 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

CVE-2024-28237 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

Impact OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute...

GHSA-X7MF-WRH9-R76C XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

Impact OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute...

PT-2024-22352 · Octoprint · Octoprint

Name of the Vulnerable Software and Affected Versions: OctoPrint versions up to and including 1.9.3 Description: OctoPrint provides a web interface for controlling consumer 3D printers. The issue allows malicious admins to configure or talk a victim with administrator rights into configuring a...

OctoPrint Security Vulnerability

OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint 1.9.3 and prior versions that originated from allowing a malicious administrator to configure or convince a victim with administrator privileges to...

Unverified Password Change

OctoPrint is vulnerable to Unverified Password Change. The vulnerability is due to improper validation within the password change functionality for admin accounts. The issue can be exploited to a malicious admin to change the passwords of other admin account...

CVE-2024-23637

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an adm...