PT-2024-17496 · Papercut · Papercut Ng

Published 2024-03-14 · Updated 2024-09-26 · CVE-2024-1223

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PaperCut NG (affected versions not specified)

Description This issue potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names, and an internal system key. For such an attack to be successful, the system must be in a specific runtime state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-488

Related Identifiers

CVE-2024-1223

ZDI-24-779

Affected Products

Papercut Ng

References · 7

• https://osv.dev/vulnerability/CVE-2024-1223 · Vendor Advisory
• https://papercut.com/kb/Main/Security-Bulletin-March-2024 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-1223 · Security Note
• https://t.me/cvenotify/96079 · Telegram Post
• https://twitter.com/CVEnew/status/1768213783233884200 · Twitter Post
• https://t.me/cvenotify/73772 · Telegram Post