CVE-2022-2888: OctoPrint vulnerable to Insufficient Session Expiration.
(updated )
If an attacker comes into the possession of a victim’s OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim’s account exists. This issue is fixed in version 1.8.3.
References
- github.com/advisories/GHSA-937f-qh3w-6g87
- github.com/octoprint/octoprint
- github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4
- github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-282.yaml
- huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629
- nvd.nist.gov/vuln/detail/CVE-2022-2888
Code Behaviors & Features
Detect and mitigate CVE-2022-2888 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →