Information Disclosure Vulnerability in OctoPrint API Key Handler by OctoPrint

CVE-2013-10077

What is CVE-2013-10077?

A vulnerability exists in OctoPrint version 1.0.0 that enables attackers to gain unauthorized access to sensitive information through the API Key Handler. Specifically, the function getSettings within the src/octoprint/server/ajax/settings.py file lacks proper access control. This flaw allows for remote exploitation, resulting in the unprotected disclosure of critical settings information. Users are advised to upgrade to version 1.1.0-rc1 or later, where security measures have been strengthened to safeguard the API key, which is now gated through enhanced permissions and reauthentication protocols.

References