~ / search / GHSA-39gf-864w-pxw4

GHSA-39gf-864w-pxw4

Unverified Password Change in OctoPrint

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-2930

Packages

EcosystemPackageAffectedFixed in
PyPI OctoPrint < 1.8.3 1.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.

References

External links from the advisory. They lead to third-party sites.