Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pysec / PYSEC-2022-282
Advisory ID pysec/PYSEC-2022-282
Aliases CVE-2022-2888
GHSA-937f-qh3w-6g87
Summary If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4
https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629
GHSA-937f-qh3w-6g87 https://github.com/advisories/GHSA-937f-qh3w-6g87
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-28T15:22:05Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/2xxx/CVE-2022-2888.json

Source Advisory: vulnrichment/CVE-2022-2888

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]