by Kastro
Paper/Archive/CVE-2024-1222

CVE-2024-1222

PaperCut PaperCut NG, PaperCut MF — Incorrect authorization controls in PaperCut NG/MF APIs

EPSS 64%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.2.992 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.

Affected

ProductAffectedFixed inSource
PaperCut NG, PaperCut MF< 23.0.723.0.7CNA
PaperCut NG, PaperCut MF< 22.1.522.1.5CNA
PaperCut NG, PaperCut MF< 21.2.1421.2.14CNA
PaperCut NG, PaperCut MF< 20.1.1020.1.10CNA
papercut_mf< 23.0.723.0.7CISA-ADP
papercut_mf< 22.1.522.1.5CISA-ADP
papercut_mf< 21.2.1421.2.14CISA-ADP
papercut_mf< 20.1.1020.1.10CISA-ADP
papercut_ng< 23.0.723.0.7CISA-ADP
papercut_ng< 22.1.522.1.5CISA-ADP
papercut_ng< 21.2.1421.2.14CISA-ADP
papercut_ng< 20.1.1020.1.10CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PaperCut (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpapercut.com/kb/Main/Security-Bulletin-March-2024