GHSA-39gf-864w-pxw4 CVE-2022-2930 PYSEC-2022-43142
Unverified Password Change in OctoPrint
- Severity
- 5.3 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 0.35%
- Chance of exploitation in the next 30 days. Higher than 28.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-620 Unverified Password Change
- Fix
1.8.3- Upgrade octoprint to this version or later
Description
Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
octoprint PyPI → 1.8.3
- pip
pip install --upgrade "octoprint>=1.8.3"- poetry
poetry add "octoprint>=1.8.3"- uv
uv add "octoprint>=1.8.3"
Severity breakdown
CVSS 3.0 5.3
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-620: Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
How to prevent it
- Architecture and Design: When prompting for a password change, force the user to provide the original password in addition to the new password.
- Architecture and Design: Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j4h9-pm27-4rfw OctoPrint has possible file exfiltration via query parameters on upload endpoints | High | Also affects octoprint |
| GHSA-p6qx-ghxm-389h OctoPrint has XSS in its Suppressed Command Notifications | Medium | Also affects octoprint |
| GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication | Medium | Also affects octoprint |
| GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt | Medium | Also affects octoprint |
| GHSA-49mj-x8jp-qvfc OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload | High | Also affects octoprint |
| GHSA-9wj4-8h85-pgrw OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint | Medium | Also affects octoprint |
| GHSA-m9jh-jf9h-x3h2 OctoPrint vulnerable to possible file extraction via upload endpoints | Medium | Also affects octoprint |
| GHSA-qw93-h6pf-226x OctoPrint Authenticated Reverse Proxy Page Authentication Bypass | Medium | Also affects octoprint |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor