CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1883 – Reflected XSS in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1883
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it could potentially lead to limited loss of confidentiality, integrity or availability. Esta es una vulnerabilidad de Cross Site Scripting reflejada en el servidor de aplicaciones PaperCut NG/MF. Un atacante puede aprovechar esta debilidad creando una URL maliciosa que contenga un script. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-76: Improper Neutralization of Equivalent Special Elements •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1882 – Server-side resource injection in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1882
This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server. Esta vulnerabilidad permite que un usuario administrador ya autenticado cree un payload malicioso que podría aprovecharse para la ejecución remota de código en el servidor que aloja el servidor de aplicaciones PaperCut NG/MF. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut MF. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EmailRenderer class. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-76: Improper Neutralization of Equivalent Special Elements •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1654 – Unauthorized write operations in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1654
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. Esta vulnerabilidad permite potencialmente operaciones de escritura no autorizadas que pueden conducir a la ejecución remota de código. Un atacante ya debe tener acceso de administrador autenticado y conocimiento tanto de un identificador interno del sistema como de los detalles de otro usuario válido para explotar esto. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-183: Permissive List of Allowed Inputs •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1223 – Improper authorization controls in PaperCut NG/MF
https://notcve.org/view.php?id=CVE-2024-1223
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state. Esta vulnerabilidad permite potencialmente la enumeración no autorizada de información de las API del dispositivo integrado. Un atacante ya debe tener conocimiento de alguna combinación de nombres de usuario válidos, nombres de dispositivos y una clave interna del sistema. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-488: Exposure of Data Element to Wrong Session •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1222 – Incorrect authorization controls in PaperCut NG/MF APIs
https://notcve.org/view.php?id=CVE-2024-1222
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls. Esto permite a los atacantes utilizar una solicitud de API formada de forma maliciosa para obtener acceso a un nivel de autorización de API con privilegios elevados. Esto se aplica a un pequeño subconjunto de llamadas API de PaperCut NG/MF. This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG. • https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-250: Execution with Unnecessary Privileges •