Is CVE-2022-3068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-3068 being exploited in the wild.

How severe is CVE-2022-3068?

Low severity, with a CVSS score of 3.1, published 21 September 2022.

Which products and versions are affected?

OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.3, GIT:introduced=0,fixed=ef95ef1c101b79394f134e8fce000e6bae046571|ECOSYSTEM:introduced=0,fixed=1.8.3.

Is there a fix for CVE-2022-3068?

Yes. OctoPrint (PyPI): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-3068 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-3068?

Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-3068: PYSEC-2022-283 - Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.

CVE-2022-3068 · Severity: low · CVSS 3.1 · Published 2022-09-21

OctoPrint is a web-based 3D printer controller used by makers and manufacturers to monitor and manage 3D printing operations. A flaw in version 1.8.0–1.8.2 allows read-only users to gain administrative plugin management capabilities (enable/disable plugins, uninstall plugins, delete settings) that should be restricted to administrators, potentially allowing unauthorized control over printer behavior and software.

Technologies: OctoPrint (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-3068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-3068 being exploited in the wild.
How severe is CVE-2022-3068?: Low severity, with a CVSS score of 3.1, published 21 September 2022.
Which products and versions are affected?: OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.3, GIT:introduced=0,fixed=ef95ef1c101b79394f134e8fce000e6bae046571|ECOSYSTEM:introduced=0,fixed=1.8.3.
Is there a fix for CVE-2022-3068?: Yes. OctoPrint (PyPI): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-3068 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-3068?: Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

OctoPrint (PyPI): upgrade to 1.8.3 or later
```
pip install "OctoPrint>=1.8.3"
```

Technical details

A privilege escalation vulnerability exists in OctoPrint's PluginManager due to an incorrect permission role assignment introduced in version 1.8.0. The LIST permission for plugins was incorrectly assigned the "manage" role instead of the "list" role, granting read-only and user group members the same rights as administrators. This allows a read-only user to enable/disable plugins, uninstall plugins, list installed plugins with full details, retrieve plugin notices, and delete orphaned plugin settings. The vulnerability is triggered on the network without authentication bypass—only requiring an existing read-only account. The issue was patched in version 1.8.3 by correcting the role assignment from "manage" to "list".

Affected products

OctoPrint OctoPrint before 1.8.3

Identifiers

CVE-2022-3068
GHSA-2p75-q37p-f852
PYSEC-2022-283

Timeline

2022-09-22: disclosed
2022-09-23: patched: Version 1.8.3 released with fix

References

https://github.com/octoprint/octoprint/commit/ef95ef1c101b79394f134e8fce000e6bae046571

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.