What’s Vulnerable › Vulnerabilities

CVE-2022-2888: Insufficient Session Expiration in octoprint/octoprint

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-21 · updated 2026-06-17
• Weakness: CWE-613

Description

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.

Affected products

• OctoPrint: before 1.8.3 — fixed in 1.8.3

How to fix

Upgrade to a fixed version: OctoPrint 1.8.3. Check the vendor advisory for mitigations.

References

• https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4
• https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629
• https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4
• https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629

Get alerted when CVE-2022-2888 or the next vulnerability affects your stack