CVE-2022-2930

Advisory

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-39gf-864w-pxw4
• https://nvd.nist.gov/vuln/detail/CVE-2022-2930
• https://github.com/octoprint/octoprint/commit/1453076ee3e47fcab2dc73664ec2d61d3ef7fc4f
• https://github.com/octoprint/octoprint
• https://huntr.dev/bounties/da6745e4-7bcc-4e9a-9e96-0709ec9f2477
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2930