Detections
Analytics

SCA: security update for OctoPrint (GHSA-xvxq-g8hw-fx4g)

medium Tenable Cloud Security Plugin ID 420694

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and
 including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application
 key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted
 login link, or a malicious app running on a victim's computer triggering the application key workflow with
 specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog
 could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise
 interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of
 the login dialog and the standalone application key confirmation dialog have been patched in the bugfix
 release 1.10.3 by individual escaping of the detected locations. A global change throughout all of
 OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to
 globally enforced automatic escaping and thus reducing the attack surface in general. The latter will also
 improve the security of third party plugins. During a transition period, third party plugins will be able
 to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be
 enforced even for third party plugins, unless they explicitly opt-out. (CVE-2024-49377)

See Also

https://github.com/advisories/GHSA-xvxq-g8hw-fx4g

Plugin Details

Severity: Medium

ID: 420694

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-49377

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 1.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2024

Vulnerability Publication Date: 11/5/2024

Reference Information

CVE: CVE-2024-49377

cwe: CWE-79