CVE-2024-23637

Katalog CVE

CVSS 4.9 · Medium EPSS 0,52%

Kerentanan Improper Authentication pada octoprint. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

Rincian

Terbit di NVD

31 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-620: Unverified Password Change

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125 patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr advisory pihak ketiga
• https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1 release notes