CVE-2024-23637

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-287 CWE-620

Affected software

No affected versions have been published.

Timeline

Published: Jan 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-236386.5Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Servi CVE-2024-236397.8Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with s CVE-2024-23644.6A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file andro CVE-2024-236404.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236417.5SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app CVE-2024-236424.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236434.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236448.1Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client CVE-2024-236456.1GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.CVE-2024-236468.8Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from availabl CVE-2024-236478.8Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protec CVE-2024-236488.8Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user request