CVE-2022-2888

CVE-2022-2888 describes Insufficient Session Expiration in OctoPrint. If an attacker obtains a victim’s OctoPrint session cookie, they can authenticate as that victim for as long as the account exists. Public docs consistently tie this to the use of a session cookie to authenticate, with impact l...

CVE-2022-2888 Insufficient Session Expiration in octoprint/octoprint

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

CVE-2022-2888 Insufficient Session Expiration in octoprint/octoprint

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

CVE-2022-2872

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

PYSEC-2022-286

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

PYSEC-2022-286

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2872 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2872 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2872 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2872

CVE-2022-2872 affects OctoPrint: the GitHub repository octoprint/octoprint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type due to misconfiguration in the file-move functionality, allowing an attacker to rename a malicious upload as a .gcode file. Severity i...

OctoPrint 代码问题漏洞

OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. OctoPrint suffers from a code issue vulnerability that stems from the fact that if an attacker obtains the victim's session cookie by any means, the attacker can use this cookie for authenticatio...

OctoPrint 安全漏洞

OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from incorrect privilege management...

OctoPrint 代码问题漏洞

OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A code issue vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from the ability to upload files with dangerous types without restriction...

PT-2022-19284 · Octoprint · Octoprint

Name of the Vulnerable Software and Affected Versions: OctoPrint versions prior to 1.8.3 Description: The issue allows an attacker to authenticate using a victim's OctoPrint session cookie as long as the victim's account exists. This can be done if the attacker comes into possession of the cookie...

The vulnerability of the OctoPrint 3D-printer controller relates to the unsafe management of privileges, allowing a malicious actor to change the account password without knowing the current password.

The vulnerability of the OctoPrint 3D-printer controller is related to insecure management of privileges. Exploiting this vulnerability allows a hacker to change the account password without knowing the current password...

ZipSlip Symlink variant allows to read any file within OctoPrint Box

Using the ZipSlip symlink variant, it is possible to steal any file from the OctoPrint remote server via an upload of a maliciously crafted archive as a language pack and download the stolen files within a backup archive. To set up the Octoprint web application, we used the dockerized version bas...

Unverified Password Change in OctoPrint

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances...

GHSA-39GF-864W-PXW4 Unverified Password Change in OctoPrint

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances...

Unauthorized Password Change

Octoprint does not prevent unauthenticated password changes. The vulnerability is due to the API not requiring the previous user password during the reset. An attacker with access to the user cookie can reset the password without knowledge of the current password...