GHSA-cc6x-8cc7-9953

Source

https://github.com/advisories/GHSA-cc6x-8cc7-9953

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-cc6x-8cc7-9953/GHSA-cc6x-8cc7-9953.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cc6x-8cc7-9953

Aliases

Published

2024-11-05T15:08:57Z

Modified

2025-01-21T18:23:41.960151Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

OctoPrint has API key access in settings without reauthentication

Details

Impact

OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account's password.

An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted.

Patches

The vulnerability will be patched in version 1.10.3.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

Database specific

{
    "github_reviewed_at": "2024-11-05T15:08:57Z",
    "github_reviewed": true,
    "nvd_published_at": "2024-11-05T19:15:07Z",
    "cwe_ids": [
        "CWE-306",
        "CWE-620"
    ],
    "severity": "MODERATE"
}

References

Affected packages

PyPI / octoprint

Package

Name: octoprint; View open source insights on deps.dev
Purl: pkg:pypi/octoprint

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.10.3

Affected versions

1.*

1.3.11

1.3.12rc1

1.3.12rc3

1.3.12

1.4.0rc1

1.4.0rc2

1.4.0rc3

1.4.0rc4

1.4.0rc5

1.4.0rc6

1.4.0

1.4.1rc1

1.4.1rc2

1.4.1rc3

1.4.1rc4

1.4.1

1.4.2

1.5.0rc1

1.5.0rc2

1.5.0rc3

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0rc1

1.6.0rc2

1.6.0rc3

1.6.0

1.6.1

1.7.0rc1

1.7.0rc2

1.7.0rc3

1.7.0

1.7.1

1.7.2

1.7.3

1.8.0rc1

1.8.0rc2

1.8.0rc3

1.8.0rc4

1.8.0rc5

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.9.0rc1

1.9.0rc2

1.9.0rc3

1.9.0rc4

1.9.0rc5

1.9.0rc6

1.9.0

1.9.1

1.9.2

1.9.3

1.10.0rc1

1.10.0rc2

1.10.0rc3

1.10.0rc4

1.10.0

1.10.1

1.10.2

Database specific

{
    "last_known_affected_version_range": "<= 1.10.2"
}