CVE-2024-1884

medium · 6.5

This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

6.5

CVSS

37.9%

EPSS (exploit prob.)

98th

EPSS percentile

2024-03-14

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-918

Affected products

Vendor	Product	Affected versions
papercut	papercut_mf	< 20.1.10
papercut	papercut_mf	>= 21.0.0, < 21.2.14
papercut	papercut_mf	>= 22.0.0, < 22.1.5
papercut	papercut_mf	>= 23.0.1, < 23.0.7
papercut	papercut_ng	< 20.1.10
papercut	papercut_ng	>= 21.0.0, < 21.2.14
papercut	papercut_ng	>= 22.0.0, < 22.1.5
papercut	papercut_ng	>= 23.0.1, < 23.0.7
apple	macos	all versions
linux	linux_kernel	all versions
microsoft	windows	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-1884