CVE-2024-23637

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125	Patch
https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1	Release Notes
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr	Third Party Advisory
https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125	Patch
https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1	Release Notes
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-31 18:15

Updated : 2024-11-21 08:58

NVD link : CVE-2024-23637

Mitre link : CVE-2024-23637

CVE.ORG link : CVE-2024-23637

JSON object : View

Products Affected

octoprint

octoprint

CWE

CWE-287

Improper Authentication

CWE-620

Unverified Password Change

{"id": "CVE-2024-23637", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2024-01-31T18:15:49.810", "references": [{"url": "https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-620"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0."}, {"lang": "es", "value": "OctoPrint es una interfaz web para impresoras 3D. Las versiones de OctoPrint hasta la 1.9.3 incluida contienen una vulnerabilidad que permite a administradores malintencionados cambiar la contrase\u00f1a de otras cuentas de administrador, incluida la suya propia, sin tener que repetir su contrase\u00f1a. Un atacante que lograra secuestrar una cuenta de administrador podr\u00eda usar esto para bloquear a los administradores reales de su instancia de OctoPrint. La vulnerabilidad se parchear\u00e1 en la versi\u00f3n 1.10.0."}], "lastModified": "2024-11-21T08:58:03.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "216857C0-BBE7-49CA-890B-A3A277108CF6", "versionEndIncluding": "1.9.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}