CVE-2025-32788

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OctoPrint/OctoPrint/commit/41ff431014edfa18ca1a01897b10463934dc7fc2	Patch
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-qw93-h6pf-226x	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-22 18:15

Updated : 2025-06-27 15:40

NVD link : CVE-2025-32788

Mitre link : CVE-2025-32788

CVE.ORG link : CVE-2025-32788

JSON object : View

Products Affected

octoprint

octoprint

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2025-32788", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-04-22T18:15:59.630", "references": [{"url": "https://github.com/OctoPrint/OctoPrint/commit/41ff431014edfa18ca1a01897b10463934dc7fc2", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-qw93-h6pf-226x", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0."}, {"lang": "es", "value": "OctoPrint proporciona una interfaz web para controlar impresoras 3D de consumo. En versiones hasta la 1.10.3 (incluida), OctoPrint presenta una vulnerabilidad que permite a un atacante eludir la redirecci\u00f3n de inicio de sesi\u00f3n y acceder directamente al HTML renderizado de ciertas p\u00e1ginas frontend. El principal riesgo reside en posibles modificaciones futuras del c\u00f3digo base que podr\u00edan basarse incorrectamente en las funciones internas vulnerables para las comprobaciones de autenticaci\u00f3n, lo que generar\u00eda vulnerabilidades de seguridad. Este problema se ha corregido en la versi\u00f3n 1.11.0."}], "lastModified": "2025-06-27T15:40:23.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "251E030A-D22B-4103-A355-257D00953C7E", "versionEndExcluding": "1.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}