🛡️ CVE-2024-49377 — octoprint

🟡 CVSS 5.5 — Medium ✅ No Known Exploit CWE-79 OSV
5.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

Impact

OctoPrint versions up until and including 1.10.2 are vulnerable to reflected XSS vulnerabilities through its Jinja2 template system, as this is not configured to enforce automatic escaping. This affects, among other places, the login dialog and the standalone application key confirmation dialog.

An attacker who successfully talked a victim into clicking on or through a malicious third party app successfully redirected a victim to a specially crafted link could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way.

Patches

The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog will be patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general.

The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

How this vulnerability can be exploited

This issue can be reached from an adjacent network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. Rated impact: confidentiality low, integrity low, availability low.

Weakness class

CVE-2024-49377 is classified as CWE-79: Cross-site Scripting (XSS). User-supplied data is written into a page without escaping, so attacker script runs in the browser of anyone who views it.

Affected software

CVE-2024-49377 is recorded against 1 package.

  • octoprint (fixed in 1.10.3)

Timeline and source

Published on 5 November 2024 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Package)
github.com (Web)

Details

Severity MEDIUM
CVSS Score 5.5
CVSS Vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CWE CWE-79
Public Exploit ✅ No
Source OSV
Published 2024-11-05
Updated 2026-08-12
Modified 2026-06-17
Fix URL N/A

Affected Packages

Software From version Fixed in
octoprint — 1.10.3

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in octoprint

CVE-2024-49377 is rated CVSS 5.5 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.