Patchfirst
Patchfirst
ChainOctoPrintPyPI:OctoPrint

OctoPrint: successive fixes (2022–2024)

6 CVEs over 4 generations, 18 May 2022 to 5 Nov 2024.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2022-143018 May 2022 First in the chain
  2. CVE-2022-143218 May 2022 No direct link to an earlier CVE
  3. CVE-2024-2363731 Jan 2024 related to CVE-2022-1430related to CVE-2022-1432
  4. CVE-2024-3297714 May 2024 related to CVE-2022-1430related to CVE-2024-23637
  5. CVE-2024-493775 Nov 2024 related to CVE-2024-32977related to CVE-2024-23637
  6. CVE-2024-514935 Nov 2024 related to CVE-2024-32977related to CVE-2024-23637
May 2022JulApr 2023Jan 2024AprJulOct CVE-2024-32977 → CVE-2024-49377: related (high confidence)CVE-2024-32977 → CVE-2024-51493: related (high confidence)CVE-2022-1430 → CVE-2024-23637: related (medium confidence)CVE-2022-1430 → CVE-2024-32977: related (medium confidence)CVE-2022-1432 → CVE-2024-23637: related (medium confidence)CVE-2024-23637 → CVE-2024-32977: related (medium confidence)CVE-2024-23637 → CVE-2024-49377: related (medium confidence)CVE-2024-23637 → CVE-2024-51493: related (medium confidence) CVE-2022-1430 18 May 2022 CVE-2022-1432 18 May 2022 CVE-2024-23637 31 Jan 2024 CVE-2024-32977 14 May 2024 CVE-2024-49377 5 Nov 2024 CVE-2024-51493 5 Nov 2024 May 2022JulJan 2023JulJan 2024AprJulOct CVE-2024-32977 → CVE-2024-49377: related (high confidence)CVE-2024-32977 → CVE-2024-51493: related (high confidence)CVE-2022-1430 → CVE-2024-23637: related (medium confidence)CVE-2022-1430 → CVE-2024-32977: related (medium confidence)CVE-2022-1432 → CVE-2024-23637: related (medium confidence)CVE-2024-23637 → CVE-2024-32977: related (medium confidence)CVE-2024-23637 → CVE-2024-49377: related (medium confidence)CVE-2024-23637 → CVE-2024-51493: related (medium confidence) CVE-2022-1430 18 May 2022 CVE-2022-1432 18 May 2022 CVE-2024-23637 31 Jan 2024 CVE-2024-32977 14 May 2024 CVE-2024-49377 5 Nov 2024 CVE-2024-51493 5 Nov 2024
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2022-1430 18 May 2022 Cross-site Scripting (XSS) - DOM in octoprint/octoprint · fixed in 1.8.0 First in chain 19.6
CVE-2022-1432 18 May 2022 Cross-site Scripting (XSS) - Generic in octoprint/octoprint · fixed in 1.8.0 First in chain 19.0
CVE-2024-23637 31 Jan 2024 OctoPrint Unverified Password Change via Access Control Settings · fixed in 1.10.0rc1 CVE-2022-1430 · related · Medium 11.8
CVE-2024-32977 14 May 2024 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled · fixed in 1.10.1 CVE-2022-1430 · related · Medium 16.9
CVE-2024-49377 5 Nov 2024 Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint · fixed in 1.10.3 CVE-2024-32977 · related · High 8.1
CVE-2024-51493 5 Nov 2024 API key access in settings without reauthentication in OctoPrint · fixed in 1.10.3 CVE-2024-32977 · related · High 7.8
↑ ↓ chooseEnter openEsc close