CVE-2024-23637 json
OctoPrint Unverified Password Change via Access Control Settings
published 2024-01-31 2 y ago modified 2026-09-10 1 mo ago also GHSA-5626-pw9c-hmjr , PYSEC-2024-29 , EUVD-2024-0120
- cvss
- 4.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
Patch / fix
- pypi octoprint 1.10.0rc1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 4.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | octoprint | <1.10.0rc1 |
1.10.0rc1 |
Affected products
- OctoPrint OctoPrint
Classification
References
-
github.com
/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125
web, patch
-
github.com
/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr
web, third-party-advisory, advisory
-
github.com
/OctoPrint/OctoPrint/releases/tag/1.10.0rc1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-23637
advisory
-
github.com
/OctoPrint/OctoPrint
package
-
github.com
/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2024-29.yaml
web
Sources
- CVE List CVE-2024-23637
- GitHub Advisory GHSA-5626-pw9c-hmjr
- NVD CVE-2024-23637
- OSV PYSEC-2024-29
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.