PT-2024-19988 · Octoprint · Octoprint

Tkruppert · Published 2024-01-31 · Updated 2024-02-08 · CVE-2024-23637

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OctoPrint versions up to and including 1.9.3

Description The issue allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance.

Recommendations For versions up to and including 1.9.3, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider thoroughly vetting who has admin access to the installation to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-620

Related Identifiers

CVE-2024-23637

GHSA-5626-PW9C-HMJR

PYSEC-2024-29

Affected Products

Octoprint

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23637.json · Exploit
• https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125 · Patch
• https://osv.dev/vulnerability/CVE-2024-23637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23637 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-29 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5626-pw9c-hmjr · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint · Note
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr · Note
• https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2024-29.yaml · Note
• https://twitter.com/VulmonFeeds/status/1752784766007386473 · Twitter Post
• https://twitter.com/CVEnew/status/1752757839469412751 · Twitter Post