What is GHSA-49wm-4fp6-h59c?

GHSA-49wm-4fp6-h59c is a security advisory published by GitHub Security Advisories with Low severity. OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type

Which CVE IDs does GHSA-49wm-4fp6-h59c cover?

GHSA-49wm-4fp6-h59c covers the following CVE IDs: CVE-2022-2872. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-49wm-4fp6-h59c?

GHSA-49wm-4fp6-h59c has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-49wm-4fp6-h59c?

GHSA-49wm-4fp6-h59c affects 1 product, including: pip/OctoPrint:\u003c 1.8.3.

GHSA-49wm-4fp6-h59cLowCVSS 3.7

OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type

Vendor

GitHub Security Advisories

Published

September 22, 2022

Last Modified

October 7, 2024

🔗 CVE IDs covered (1)

CVE-2022-2872 →

📋 Description

OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a .gcode file. Version 1.8.3 contains a patch.

🎯 Affected products1

pip/OctoPrint:< 1.8.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-2872
https://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0
https://huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56
https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-286.yaml
https://github.com/advisories/GHSA-49wm-4fp6-h59c