441 matches found
Privilage Escalation
octoprint is vulnerable to privilege escalation. The vulnerability exists in getadditionalpermissions function of init.py because the plugin manager role based list permission is not properly restricted which allows a low privileged user with read-only access to modify the admin environment...
Arbitrary File Upload
octoprint is vulnerable to arbitrary file upload. The vulnerability exists due to misconfiguration in move file functionality which allows an attacker to upload malicious files and change the file extension of the uploaded files...
Insufficient Session Expiration
octoprint is vulnerable to insecure insufficient session expiration. The vulnerability exists because the session expiration is not properly handled in finduser function in users.py which allows an attacker to use old session credentials or session IDs for authorization...
GHSA-49WM-4FP6-H59C OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type
OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a .gcode file. Version 1.8.3 contains a patch...
OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type
OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a .gcode file. Version 1.8.3 contains a patch...
OctoPrint vulnerable to Insufficient Session Expiration.
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. This issue is fixed in version 1.8.3...
GHSA-937F-QH3W-6G87 OctoPrint vulnerable to Insufficient Session Expiration.
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. This issue is fixed in version 1.8.3...
octoprint-nanny (>=0.10.0rc1, <=0.13.4) potentially affected by CVE-2022-2888 via octoprint (>=1.8.0rc3, <=1.8.2)
octoprint PYPI version =1.8.0rc3, =0.10.0rc1, =0.13.4 Source cves: CVE-2022-2888 Source advisory: GHSA-937F-QH3W-6G87...
OctoPrint Improper Privilege Management vulnerability
OctoPrint prior to 1.8.3 allows a user with read access only to access a privileged user's account and functionality. Version 1.8.3 contains a patch for this issue...
octoprint-nanny (>=0.10.0rc1, <=0.13.4) potentially affected by CVE-2022-2888 via octoprint (>=1.8.0rc3, <=1.8.2)
octoprint PYPI version =1.8.0rc3, =0.10.0rc1, =0.13.4 Source cves: CVE-2022-2888 Source advisory: OSV:GHSA-937F-QH3W-6G87...
GHSA-2P75-Q37P-F852 OctoPrint Improper Privilege Management vulnerability
OctoPrint prior to 1.8.3 allows a user with read access only to access a privileged user's account and functionality. Version 1.8.3 contains a patch for this issue...
CVE-2022-3068
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...
CVE-2022-2888
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...
Code injection
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...
Input validation
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...
PYSEC-2022-283
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...
PYSEC-2022-282
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...
octoprint-nanny (>=0.10.0rc1, <=0.13.4) potentially affected by CVE-2022-2888 via octoprint (>=1.8.0rc3, <=1.8.2)
octoprint PYPI version =1.8.0rc3, =0.10.0rc1, =0.13.4 Source cves: CVE-2022-2888 Source advisory: OSV:PYSEC-2022-282...
PYSEC-2022-283
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...
PYSEC-2022-282
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...