A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key
.
The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777.
The affected component should be upgraded.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
References 7
https://github.com/OctoPrint/OctoPrint/
cna@vuldb.com
https://github.com/OctoPrint/OctoPrint/commit/b4699825d6ab92d5451e5b1e3a06dfb81…
cna@vuldb.com
https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.1
cna@vuldb.com
https://vuldb.com/cve/CVE-2014-125135
cna@vuldb.com
https://vuldb.com/submit/994545
cna@vuldb.com
https://vuldb.com/vuln/426129
cna@vuldb.com
https://vuldb.com/vuln/426129/cti
cna@vuldb.com