EUVD-2024-1369

Malicious code in bioql PyPI...

Authentication Bypass

OctoPrint is vulnerable to an Authentication Bypass. The vulnerability is due to an unauthenticated attacker being able to bypass authentication by spoofing their IP via the X-Forwarded-For header when the autologinLocal option is enabled, even if they are from networks not configured as...

OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

Impact OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if they come from networks that are not configured as localNetworks, by...

CVE-2024-32977

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-32977

OctoPrint has a vulnerability (CVE-2024-32977) that allows an unauthenticated attacker to bypass authentication when autologinLocal is enabled in config.yaml on versions up to 1.10.0. The bypass occurs by spoofing the client IP with the X-Forwarded-For header, even from networks not in localNetwo...

PT-2024-25024 · Octoprint · Octoprint

Name of the Vulnerable Software and Affected Versions: OctoPrint versions up to and including 1.10.0 Description: OctoPrint provides a web interface for controlling consumer 3D printers. The issue allows an unauthenticated attacker to bypass authentication if the autologinLocal option is enabled...