CVE-2024-23637

MEDIUM EPSS 40.1%
Published Jan 31, 20242y ago · Modified Jun 17, 20262w ago
4.9 CVSS 3.1
Medium
Find Similar
Published Jan 31, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

CVSS Details

Base Score
4.9
Exploitability
1.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
40.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-287 Improper Authentication Authentication
CWE-620

Affected Products 1

VendorProductVersionRange
octoprintoctoprint* ≤1.9.3

References 3

  • github.com https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125
    Patch
  • github.com https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1
    Release Notes
  • github.com https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr
    Third Party Advisory

Remediation

  • github.com https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125
    Patch