Quick answers
- Is CVE-2022-2930 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-2930 being exploited in the wild.
- How severe is CVE-2022-2930?
- Low severity, with a CVSS score of 3.1, published 22 August 2022.
- Which products and versions are affected?
- OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.3, GIT:introduced=0,fixed=1453076ee3e47fcab2dc73664ec2d61d3ef7fc4f|ECOSYSTEM:introduced=0,fixed=1.8.3.
- Is there a fix for CVE-2022-2930?
- Yes. OctoPrint (PyPI): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-2930 attacked?
- It is attacked with local access, in a web application.
- Am I affected by CVE-2022-2930?
- Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- OctoPrint (PyPI): upgrade to 1.8.3 or later
pip install "OctoPrint>=1.8.3"
Technical details
The vulnerability is an improper access control flaw (CWE-620) in OctoPrint's password change endpoint. Versions before 1.8.3 failed to require verification of the current password when a user changed their own password. An attacker with local access to an unlocked session, or via CSRF/session compromise, could change a user's password without providing the original password, leading to account lockout or takeover. The fix, applied in version 1.8.3, mandates that users without the SETTINGS permission must provide their current password to change it. Administrators retain the ability to reset user passwords without the current password.
Affected products
- OctoPrint OctoPrint before 1.8.3
Identifiers
- CVE-2022-2930
- GHSA-39gf-864w-pxw4
- PYSEC-2022-43142
Timeline
- 2022-08-23: disclosed
- 2022-08-22: patched: Fix committed to dev branch