CVE-2024-1221 Improper access controls on APIs on Linux and macOS in PaperCut NG/MF

2024-03-1403:01:05

CWE-76

PaperCut

www.cve.org

vulnerability

access controls

apis

linux

macos

papercut ng/mf

file exposure

cve-2024-1221

server

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

28.8%

JSON

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "MacOS",
      "Linux"
    ],
    "product": "PaperCut NG, PaperCut MF",
    "vendor": "PaperCut",
    "versions": [
      {
        "changes": [
          {
            "at": "23.0.7",
            "status": "unaffected"
          }
        ],
        "lessThan": "23.0.7",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "22.1.5",
            "status": "unaffected"
          }
        ],
        "lessThan": "22.1.5",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "21.2.14",
            "status": "unaffected"
          }
        ],
        "lessThan": "21.2.14",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "20.1.10",
            "status": "unaffected"
          }
        ],
        "lessThan": "20.1.10",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]