GHSA-5w5x-q9p5-9qg3 CVE-2022-2822 PYSEC-2026-887
OctoPrint does not have rate limiting on the login page
- Severity
- 3.7 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.87%
- Chance of exploitation in the next 30 days. Higher than 58.74% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-307 Improper Restriction of Excessive Authentication Attempts
- Fix
- None yet
- No fixed version published
Description
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that limits the rate of failed login attempts.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| octoprint | <= 1.7.3 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j4h9-pm27-4rfw OctoPrint has possible file exfiltration via query parameters on upload endpoints | High | Also affects octoprint |
| GHSA-p6qx-ghxm-389h OctoPrint has XSS in its Suppressed Command Notifications | Medium | Also affects octoprint |
| GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication | Medium | Also affects octoprint |
| GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt | Medium | Also affects octoprint |
| GHSA-49mj-x8jp-qvfc OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload | High | Also affects octoprint |
| GHSA-9wj4-8h85-pgrw OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint | Medium | Also affects octoprint |
| GHSA-m9jh-jf9h-x3h2 OctoPrint vulnerable to possible file extraction via upload endpoints | Medium | Also affects octoprint |
| GHSA-qw93-h6pf-226x OctoPrint Authenticated Reverse Proxy Page Authentication Bypass | Medium | Also affects octoprint |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor