Количество 3
Количество 3

CVE-2024-49377
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 rel
CVE-2024-49377
OctoPrint provides a web interface for controlling consumer 3D printer ...
GHSA-xvxq-g8hw-fx4g
OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
---|---|---|---|---|
![]() | CVE-2024-49377 OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 rel | CVSS3: 5.5 | 0% Низкий | 10 месяцев назад |
CVE-2024-49377 OctoPrint provides a web interface for controlling consumer 3D printer ... | CVSS3: 5.5 | 0% Низкий | 10 месяцев назад | |
GHSA-xvxq-g8hw-fx4g OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates | CVSS3: 5.5 | 0% Низкий | 10 месяцев назад |
Уязвимостей на страницу