GHSA-937f-qh3w-6g87

OctoPrint vulnerable to Insufficient Session Expiration.

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-2888

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	OctoPrint	< 1.8.3	1.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. This issue is fixed in version 1.8.3.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-2888 advisory
https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4 web
https://github.com/octoprint/octoprint package
https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-282.yaml web
https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629 web