CVE-2024-47177

2024-09-2622:15:04

CWE-77

GitHub_M

web.nvd.nist.gov

cups

printing

vulnerability

foomaticripcommandline

remote command execution

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

Percentile

10.9%

JSON

CUPS is a standards-based, open-source printing system, and cups-filters provides backends, filters, and other software for CUPS 2.x to use on non-Mac OS systems. Any value passed to FoomaticRIPCommandLine via a PPD file will be executed as a user controlled command. When combined with other logic bugs as described in CVE_2024-47176, this can lead to remote command execution.

Affected configurations

Vulners

Vulnrichment

Node

openprintingcupsRange≤2.0.1

VendorProductVersionCPE
openprintingcups*cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openprinting	cups	*	cpe:2.3:a:openprinting:cups::::::::

CNA Affected

[
  {
    "vendor": "OpenPrinting",
    "product": "cups-filters",
    "versions": [
      {
        "version": "<= 2.0.1",
        "status": "affected"
      }
    ]
  }
]