Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: PaperCut NG, PaperCut MF 20.1.10, 21.2.14 and 2 more versions Clear all filters
TI-2024-01753 CVE-2024-1884 · GHSA-qhj3-r7hp-qwc2

Server Side Request Forgery in PaperCut NG/MF

Priority MEDIUM 62

This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attack…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.37934 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-918
TI-2024-01752 CVE-2024-1883 · GHSA-6xfp-26pf-r3p6

Reflected XSS in PaperCut NG/MF

Priority MEDIUM 63

This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.61472 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-76
TI-2024-01751 CVE-2024-1882 · GHSA-gmmm-pvv4-ww8g

Server-side resource injection in PaperCut NG/MF

Priority LOW 37

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01411 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-76
TI-2024-01537 CVE-2024-1654 · GHSA-hv4j-7wh2-m4p5

Unauthorized write operations in PaperCut NG/MF

Priority LOW 36

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01308 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-183
TI-2024-01137 CVE-2024-1223 · GHSA-vfgc-wr54-m4r5

Improper authorization controls in PaperCut NG/MF

Priority LOW 22

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00445 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-488
TI-2024-01136 CVE-2024-1222 · GHSA-8q2g-9f98-xxwf

Incorrect authorization controls in PaperCut NG/MF APIs

Priority HIGH 84

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.63984 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-250
TI-2024-01135 CVE-2024-1221 · GHSA-h4rp-4mpv-g4rm

Improper access controls on APIs on Linux and macOS in PaperCut NG/MF

Priority LOW 16

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00546 Published 2024-03-14 Fixed in 23.0.7, 22.1.5 +2 CWE-76