# CVE-2022-2930: PYSEC-2022-43142 - Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Source: https://junglewise.ai/threats/cve-2022-2930-octoprint-unverified-password-change  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-2930 · Severity: low · CVSS 3.1 · Published 2022-08-22

OctoPrint is a web-based interface for managing 3D printers. Prior to version 1.8.3, the password change function did not require users to verify their current password, allowing attackers with local access or session hijacking capabilities to lock legitimate users out of their accounts or take them over entirely.

Technologies: [OctoPrint (PyPI)](https://junglewise.ai/threats/technologies/octoprint). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-2930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-2930 being exploited in the wild.

**How severe is CVE-2022-2930?** Low severity, with a CVSS score of 3.1, published 22 August 2022.

**Which products and versions are affected?** OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.3, GIT:introduced=0,fixed=1453076ee3e47fcab2dc73664ec2d61d3ef7fc4f|ECOSYSTEM:introduced=0,fixed=1.8.3.

**Is there a fix for CVE-2022-2930?** Yes. OctoPrint (PyPI): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-2930 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2022-2930?** Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- OctoPrint (PyPI): upgrade to 1.8.3 or later

  ```sh
  pip install "OctoPrint>=1.8.3"
  ```


## Technical details

The vulnerability is an improper access control flaw (CWE-620) in OctoPrint's password change endpoint. Versions before 1.8.3 failed to require verification of the current password when a user changed their own password. An attacker with local access to an unlocked session, or via CSRF/session compromise, could change a user's password without providing the original password, leading to account lockout or takeover. The fix, applied in version 1.8.3, mandates that users without the SETTINGS permission must provide their current password to change it. Administrators retain the ability to reset user passwords without the current password.

## Affected products

- OctoPrint OctoPrint before 1.8.3

## Identifiers

- CVE-2022-2930
- GHSA-39gf-864w-pxw4
- PYSEC-2022-43142

## Timeline

- 2022-08-23: disclosed
- 2022-08-22: patched: Fix committed to dev branch

## References

- [https://github.com/octoprint/octoprint/commit/1453076ee3e47fcab2dc73664ec2d61d3ef7fc4f](https://github.com/octoprint/octoprint/commit/1453076ee3e47fcab2dc73664ec2d61d3ef7fc4f)

## Related threats

- [OctoPrint stored XSS in connection parameters](https://junglewise.ai/threats/cve-2026-123364-octoprint-provides-a-web-interface-for-controlling-consumer-3d)
- [OctoPrint file exfiltration via query parameters in upload endpoints](https://junglewise.ai/threats/cve-2026-54134-octoprint-file-exfiltration-via-query-parameters-in-upload)
- [OctoPrint XSS in Suppressed Command Notifications](https://junglewise.ai/threats/cve-2026-35163-octoprint-xss-in-suppressed-command-notifications)
- [PYSEC-2026-1716 - OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication](https://junglewise.ai/threats/cve-2026-23892-octoprint-has-timing-side-channel-vulnerability-in-api-key)
- [PYSEC-2026-1714 - OctoPrint vulnerable to XSS in Action Commands Notification and Prompt](https://junglewise.ai/threats/cve-2025-64187-octoprint-vulnerable-to-xss-in-action-commands-notification-and)