Логотип exploitDog
bind:CVE-2024-49377
Консоль
Логотип exploitDog

exploitDog

bind:CVE-2024-49377

Количество 3

Количество 3

nvd логотип

CVE-2024-49377

10 месяцев назад

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 rel

CVSS3: 5.5
EPSS: Низкий
debian логотип

CVE-2024-49377

10 месяцев назад

OctoPrint provides a web interface for controlling consumer 3D printer ...

CVSS3: 5.5
EPSS: Низкий
github логотип

GHSA-xvxq-g8hw-fx4g

10 месяцев назад

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

CVSS3: 5.5
EPSS: Низкий

Уязвимостей на страницу

Уязвимость
CVSS
EPSS
Опубликовано
nvd логотип
CVE-2024-49377

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 rel

CVSS3: 5.5
0%
Низкий
10 месяцев назад
debian логотип
CVE-2024-49377

OctoPrint provides a web interface for controlling consumer 3D printer ...

CVSS3: 5.5
0%
Низкий
10 месяцев назад
github логотип
GHSA-xvxq-g8hw-fx4g

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

CVSS3: 5.5
0%
Низкий
10 месяцев назад

Уязвимостей на страницу