PaperCut MF < 24.1.9.76515 / 25.x < 25.0.12.76509 / 26.x < 26.0.4.76507 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(341348);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id("CVE-2026-81578", "CVE-2026-82078");

  script_name(english:"PaperCut MF < 24.1.9.76515 / 25.x < 25.0.12.76509 / 26.x < 26.0.4.76507 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"PaperCut MF installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of PaperCut MF installed on the remote Windows host is prior to 24.1.9.76515 or 25.x prior to 25.0.12.76509,
or 26.x prior to 26.0.4.76507. It is, therefore, affected by the following vulnerabilities:

  - An authentication bypass vulnerability exists in the web management interface due to improper access
    controls. An unauthenticated, remote attacker can exploit this, to bypass authentication and modify
    certain system configurations. (CVE-2026-81578)

  - A arbitrary code execution vulnerability exists in the database connection utilities due to improper
    validation against an allowlist of approved drivers. An authenticated, remote attacker can exploit this to
    execute arbitrary Java bytecode residing on the application classpath under the security context of the
    server process. (CVE-2026-82078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?afb6ea15");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PaperCut MF version 24.1.9.76515, 25.0.12.76509, 26.0.4.76507, or later.");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-82078");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:papercut:papercut_mf");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("papercut_mf_win_installed.nbin");
  script_require_keys("installed_sw/PaperCut MF", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'PaperCut MF', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '24.1.9.76515'},
        {'min_version': '25', 'fixed_version': '25.0.12.76509'},
        {'min_version': '26', 'fixed_version': '26.0.4.76507'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);