VulnerabilityDeferred
CVE-2014-125135
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0.
MEDIUM 6.9EPSS —
Does this matter?
Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.
Description
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-320, CWE-321
- Source
- cna@vuldb.com
References
- https://github.com/OctoPrint/OctoPrint/
- https://github.com/OctoPrint/OctoPrint/commit/b4699825d6ab92d5451e5b1e3a06dfb81f86e777
- https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.1
- https://vuldb.com/cve/CVE-2014-125135
- https://vuldb.com/submit/994545
- https://vuldb.com/vuln/426129
- https://vuldb.com/vuln/426129/cti
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.