Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) OctoPrint is a snappy web interface for your 3D printer Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Jinja2 template system. An attacker can retrieve or modify sensitive configuration settings, interrupt prints, or otherwise interact with the instance maliciously. Note: The attacker has to redirect a victim to a specially crafted link or persuade the victim to click through a malicious third-party app How to fix Cross-site Scripting (XSS)? Upgrade `OctoPrint` to version 1.10.3 or higher.	[,1.10.3)
M Unverified Password Change OctoPrint is a snappy web interface for your 3D printer Affected versions of this package are vulnerable to Unverified Password Change due to improper authentication in the settings interface. An attacker can gain unauthorized access to API keys and potentially disrupt system operations by exploiting the lack of reauthentication requirements. How to fix Unverified Password Change? Upgrade `OctoPrint` to version 1.10.3 or higher.	[,1.10.3)
H Authentication Bypass by Spoofing OctoPrint is a snappy web interface for your 3D printer Affected versions of this package are vulnerable to Authentication Bypass by Spoofing due to the `autologinLocal` configuration option. An attacker can bypass authentication controls by spoofing their IP address using the `X-Forwarded-For` header. Note: If autologin is not enabled, this vulnerability does not have any impact. How to fix Authentication Bypass by Spoofing? Upgrade `OctoPrint` to version 1.10.1 or higher.	[,1.10.1)

Go back to all versions of this package