CVE-2024-1222

high · 8.6

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.

8.6

CVSS

64.0%

EPSS (exploit prob.)

99th

EPSS percentile

2024-03-14

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses

CWE-250

Affected products

Vendor	Product	Affected versions
papercut	papercut_mf	< 20.1.10
papercut	papercut_mf	>= 21.0.0, < 21.2.14
papercut	papercut_mf	>= 22.0.0, < 22.1.5
papercut	papercut_mf	>= 23.0.1, < 23.0.7
papercut	papercut_ng	< 20.1.10
papercut	papercut_ng	>= 21.0.0, < 21.2.14
papercut	papercut_ng	>= 22.0.0, < 22.1.5
papercut	papercut_ng	>= 23.0.1, < 23.0.7
apple	macos	all versions
linux	linux_kernel	all versions
microsoft	windows	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-1222