CVE-2022-2872

LOW3.7EPSS 0.22%

OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type

發布日:2022/9/22修改日:2024/10/7

也稱為:GHSA-49wm-4fp6-h59cPYSEC-2022-286

描述

OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a `.gcode` file. Version 1.8.3 contains a patch.

受影響套件(2)

PyPI/octoprintfrom 0, < 1.8.3
PyPI/octoprintfrom 0, < 3e3c11811e216fb371a33e28412df83f9701e5b0 | from 0, < 1.8.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	LOW3.7	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-2872
PATCHhttps://github.com/octoprint/octoprint
WEBhttps://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-286.yaml
WEBhttps://huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56