// For flags

CVE-2018-16710

 

Severity Score

9.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the public internet is a terrible idea, and I really can't emphasize that enough.

** EN DISPUTA ** OctoPrint hasta la versión 1.3.9 permite que atacantes remotos obtengan información sensible o provoquen una denegación de servicio (DoS) mediante peticiones HTTP en el puerto 8081. NOTA: el fabricante discute la relevancia de este informe debido a que su documentación indica que con "reenvío ciego de puertos... poner OctoPrint en el Internet público es una idea terrible, y no podemos remarcarlo lo suficiente".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-09-07 CVE Reserved
  • 2018-09-07 CVE Published
  • 2024-09-17 CVE Updated
  • 2024-09-17 EPSS Updated
  • 2024-09-17 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://github.com/foosel/OctoPrint/issues/2814 2024-09-17
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Octoprint
Search vendor "Octoprint"
 Octoprint
Search vendor "Octoprint" for product "Octoprint"
 <= 1.3.9
Search vendor "Octoprint" for product "Octoprint" and version " <= 1.3.9"
-
Affected