High severity · published Aug 15, 2022
CVE-2022-2822
An attacker can freely brute force username and password and can takeover any account
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Octoprint · Octoprint
before 1.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2822
Patch
https://github.com/octoprint/octoprint/commit/82c892ba40b3741d1b7711d949e56af64f5bc2de
Exploit
https://huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d
More from Octoprint
9.4
CVE-2024-32977
OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled
9.1
CVE-2018-16710
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081
8.8
CVE-2025-58180
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
8.8
CVE-2022-3068
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3
7.8
CVE-2022-2930
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3