CVE-2018-16710

Advisory

Affected versions of OctoPrint allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081 as the default behavior. From version 1.5.0rc1 onwards, access control is enabled by default.
NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the public internet is a terrible idea, and I really can't emphasize that enough."

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/foosel/OctoPrint/issues/2814
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16710
• https://github.com/OctoPrint/OctoPrint/commit/c0c6dd7c7b05233edb091bc75b7bf8ce5e50c179