Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2013-10077— OctoPrint API Key settings.py getSettings information disclosure

Quick assessment

Affected
n/a OctoPrint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OctoPrint 1.0.0 中发现了一个安全弱点。该问题影响组件"API Key Handler"中文件 src/octoprint/server/ajax/settings.py 的 getSettings 函数。此漏洞可导致信息泄露，且可被远程利用。目前该漏洞的利用方法已公开，可能被用于攻击。升级到版本 1.1.0-rc1 可修复此问题，相关补丁编号为 eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954。建议立即升级受影响组件。该问题源于 2013 年发布的版本，当时尚未实

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2013-10077

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OctoPrint API Key settings.py getSettings information disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- OctoPrint 1.0.0 cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2013-10077

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2013-10077

请登录查看更多情报信息。

Vendor Pages for CVE-2013-10077 (2)

Same Patch Batch · n/a · 2026-10-26 · 44 CVEs total

CVE-2026-116106 7.3 HIGH HeyCyan App FileProvider access control
CVE-2014-125135 7.3 HIGH OctoPrint Flask Secret Key hard-coded key
CVE-2026-116253 7.3 HIGH DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
CVE-2026-116257 7.3 HIGH BillaBear Installation InstallController.php processInstall missing authentication
CVE-2026-116260 7.3 HIGH libimobiledevice AFC Service afc.c service_receive double free
CVE-2026-116113 6.3 MEDIUM GouGuOA Api.php chunkUpload unrestricted upload
CVE-2026-116258 6.3 MEDIUM libimobiledevice AFC afc.c heap-based overflow
CVE-2026-116120 5.6 MEDIUM NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of reso
CVE-2026-116119 5.5 MEDIUM NocoDB Password-Reset Flow users.service.ts race condition
CVE-2026-116280 5.5 MEDIUM Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery
CVE-2026-116262 5.4 MEDIUM libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based
CVE-2026-116259 5.3 MEDIUM libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption
CVE-2026-116274 4.3 MEDIUM JIZHICMS Front-end Order OrderController.php pay improper authorization
CVE-2026-116282 4.3 MEDIUM Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
CVE-2026-116283 4.3 MEDIUM Kameleo Local API profiles information disclosure
CVE-2026-116284 4.3 MEDIUM Kameleo Local API user-info information disclosure
CVE-2026-116105 3.7 LOW HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
CVE-2026-116121 3.7 LOW NocoDB Registration users.service.ts race condition
CVE-2026-116123 3.7 LOW NocoDB signup validatePassword excessive authentication
CVE-2026-116122 3.7 LOW NocoDB Sign-in Endpoint AuthService.validateUser information disclosure

Showing top 20 of 44 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: OctoPrint
Same vendor: n/a
Same weakness: CWE-200