Vulnerability · Published Sep 26, 2024 · Assigned by PaperCut
CVE-2024-8405Arbitrary File Creation in PaperCut NG/MF Web Print leading to a Denial of Service attack
Medium 6.1
In plain English
A medium-severity command injection in PaperCut NG, PaperCut MF from PaperCut. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PaperCut | PaperCut NG, PaperCut MF | 0 – before 23.0.9 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H