Vulnerability · Published Mar 14, 2024 · Assigned by PaperCut
CVE-2024-1222Incorrect authorization controls in PaperCut NG/MF APIs
High 8.6
In plain English
A high-severity security flaw in PaperCut NG, PaperCut MF from PaperCut. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 64.0% (higher than 99.2% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)64.0%top 0.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PaperCut | PaperCut NG, PaperCut MF | 0 – before 23.0.70 – before 22.1.50 – before 21.2.140 – before 20.1.10 |
Weakness: CWE-250 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L