CVE-2022-2930

Unverified Password Change in octoprint/octoprint

5.3 MediumFix available

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.35%Down 0.5 points since Aug 23, 2022

What each source reports

CVE List Score used 5.3

Unverified Password Change in octoprint/octoprint

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Record: CVE-2022-2930
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-620
Updated: 2026-11-02

EUVDEUVD-2022-0178 5.3

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Record: EUVD-2022-0178
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-39gf-864w-pxw4 5.3

Unverified Password Change in OctoPrint

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.

Record: GHSA-39gf-864w-pxw4
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-620
Updated: 2026-11-02

NVD 7.8

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Record: CVE-2022-2930
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-620
Updated: 2026-11-02

OSV 5.3

Unverified Password Change in octoprint/octoprint

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Record: CVE-2022-2930
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-620
Updated: 2026-11-02

OSVGHSA-39gf-864w-pxw4 5.3

Unverified Password Change in OctoPrint

Record: GHSA-39gf-864w-pxw4
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-620
Updated: 2026-11-02

OSVPYSEC-2022-43142 7.8

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.

Record: PYSEC-2022-43142
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`octoprint` PyPI	before 1.8.3	1.8.3
`octoprint` PyPI	before 1.8.3, plus listed versions 1.3.111.3.121.3.12rc11.3.12rc31.4.0 Show 39 moreShow less 1.4.0rc11.4.0rc21.4.0rc31.4.0rc41.4.0rc51.4.0rc61.4.11.4.1rc11.4.1rc21.4.1rc31.4.1rc41.4.21.5.01.5.0rc11.5.0rc21.5.0rc31.5.11.5.21.5.31.6.01.6.0rc11.6.0rc21.6.0rc31.6.11.7.01.7.0rc11.7.0rc21.7.0rc31.7.11.7.21.7.31.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.11.8.2	1.8.3
`octoprint` PyPI	before 1.8.3, plus listed versions 1.3.111.3.121.3.12rc11.3.12rc31.4.0 Show 45 moreShow less 1.4.0rc11.4.0rc21.4.0rc31.4.0rc41.4.0rc51.4.0rc61.4.11.4.1rc11.4.1rc21.4.1rc31.4.1rc41.4.21.5.01.5.0rc11.5.0rc21.5.0rc31.5.11.5.21.5.31.6.01.6.0rc11.6.0rc21.6.0rc31.6.11.7.01.7.0rc11.7.0rc21.7.0rc31.7.11.7.21.7.31.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.11.8.21.2.181.2.18rc11.2.17rc31.2.17rc21.2.17rc11.2.16	1.8.3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2930 is a medium vulnerability (CVSS 5.3) in Octoprint, published August 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in octoprint 1.8.3.

References

This page doesn't list everything

Left out here: 23 versions. The JSON record has them.