CVE-2024-23637
Medium
Description
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
SeverityMedium
CVSS4.2
Exploit probability—
ProductOctoprint
PublishedJan 31, 2024
First seenJan 31, 2024
Weakness typeCWE-287Improper authenticationCWE-620CWE-620
How to fix
Update
- octoprint1.10.0rc1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| octoprint octoprint | v ≤ 1.9.3 | — |
| octoprintPyPI | v < 1.10.0rc1 | 1.10.0rc1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.