Vulnerability · Published Mar 14, 2024 · Assigned by PaperCut
CVE-2024-1884Server Side Request Forgery in PaperCut NG/MF
Medium 6.5
In plain English
A medium-severity server-side request forgery in PaperCut NG, PaperCut MF from PaperCut. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 37.9% (higher than 99% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)37.9%top 1.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PaperCut | PaperCut NG, PaperCut MF | 0 – before 23.0.70 – before 22.1.50 – before 21.2.140 – before 20.1.10 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N