PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(341347);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id("CVE-2026-81578", "CVE-2026-82078");

  script_name(english:"PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"PaperCut NG installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of PaperCut NG installed on the remote Windows host is prior to 24.1.9.76516 or 25.x prior to 25.0.12.76510,
or 26.x prior to 26.0.4.76508. It is, therefore, affected by the following vulnerabilities:

  - An authentication bypass vulnerability exists in the web management interface due to improper access
    controls. An unauthenticated, remote attacker can exploit this, to bypass authentication and modify
    certain system configurations. (CVE-2026-81578)

  - A arbitrary code execution vulnerability exists in the database connection utilities due to improper
    validation against an allowlist of approved drivers. An authenticated, remote attacker can exploit this to
    execute arbitrary Java bytecode residing on the application classpath under the security context of the
    server process. (CVE-2026-82078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?afb6ea15");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PaperCut NG version 24.1.9.76516, 25.0.12.76510, 26.0.4.76508, or later.");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-82078");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:papercut:papercut_ng");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("papercut_ng_win_installed.nbin");
  script_require_keys("installed_sw/PaperCut NG", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'PaperCut NG', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '24.1.9.76516'},
        {'min_version': '25', 'fixed_version': '25.0.12.76510'},
        {'min_version': '26', 'fixed_version': '26.0.4.76508'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);