PT-2022-19284 · Octoprint · Octoprint

Published 2022-09-21 · Updated 2022-09-22 · CVE-2022-2888

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OctoPrint versions prior to 1.8.3

Description The issue allows an attacker to authenticate using a victim's OctoPrint session cookie as long as the victim's account exists. This can be done if the attacker comes into possession of the cookie through any means.

Recommendations For versions prior to 1.8.3, update to version 1.8.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of OctoPrint until the update can be applied.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-2888

GHSA-937F-QH3W-6G87

PYSEC-2022-282

Affected Products

Octoprint

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2888.json · Exploit
• 🔥 https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629 · Exploit
• https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2888 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-282 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2888 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-937f-qh3w-6g87 · Vendor Advisory
• https://github.com/octoprint/octoprint · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-282.yaml · Note
• https://t.me/cvenotify/36684 · Telegram Post
• https://t.me/cvenotify/36589 · Telegram Post
• https://t.me/cibsecurity/50197 · Telegram Post