ghsa-5w5x-q9p5-9qg3
Vulnerability from github
Published
2022-08-16 00:00
Modified
2023-09-01 21:55
Severity ?
Summary
OctoPrint does not have rate limiting on the login page
Details
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel
and maintenance
branches of the repository have a fix that limits the rate of failed login attempts.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "OctoPrint" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "1.7.3" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-2822" ], "database_specific": { "cwe_ids": [ "CWE-307" ], "github_reviewed": true, "github_reviewed_at": "2022-08-18T19:18:01Z", "nvd_published_at": "2022-08-15T11:21:00Z", "severity": "LOW" }, "details": "OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The `devel` and `maintenance` branches of the repository have a fix that limits the rate of failed login attempts.", "id": "GHSA-5w5x-q9p5-9qg3", "modified": "2023-09-01T21:55:17Z", "published": "2022-08-16T00:00:31Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2822" }, { "type": "WEB", "url": "https://github.com/octoprint/octoprint/commit/82c892ba40b3741d1b7711d949e56af64f5bc2de" }, { "type": "PACKAGE", "url": "https://github.com/octoprint/octoprint" }, { "type": "WEB", "url": "https://huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "OctoPrint does not have rate limiting on the login page" }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.