CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1654 – Unauthorized write operations in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1654
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. Esta vulnerabilidad permite potencialmente operaciones de escritura no autorizadas que pueden conducir a la ejecución remota de código. Un atacante ya debe tener acceso de administrador autenticado y conocimiento tanto de un identificador interno del sistema como de los detalles de otro usuario válido para explotar esto. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-183: Permissive List of Allowed Inputs •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1223 – Improper authorization controls in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1223
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state. Esta vulnerabilidad permite potencialmente la enumeración no autorizada de información de las API del dispositivo integrado. Un atacante ya debe tener conocimiento de alguna combinación de nombres de usuario válidos, nombres de dispositivos y una clave interna del sistema. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1222 – Incorrect authorization controls in PaperCut NG/MF APIs
https://notcve.org/view.php?id=CVE-2024-1222
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls. Esto permite a los atacantes utilizar una solicitud de API formada de forma maliciosa para obtener acceso a un nivel de autorización de API con privilegios elevados. Esto se aplica a un pequeño subconjunto de llamadas API de PaperCut NG/MF. This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1221 – Improper access controls on APIs on Linux and macOS in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1221
This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers. Esta vulnerabilidad potencialmente permite que los archivos en un servidor PaperCut NG/MF queden expuestos utilizando un payload formado específicamente contra el endpoint API afectado. El atacante debe realizar algún reconocimiento para conocer un token del sistema. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-20: Improper Input Validation •
CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-6006 – Local privilege escalation
https://notcve.org/view.php?id=CVE-2023-6006
This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must be able to write into the local C Drive. In addition, the attacker must have admin privileges to enable Print Archiving or encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. • https://www.papercut.com/kb/Main/CommonSecurityQuestions https://www.papercut.com/kb/Main/Security-Bulletin-November-2023 • CWE-269: Improper Privilege Management •