CVE-2024-1654: high-severity vulnerability in PaperCut NG, PaperCut MF
Unauthorized write operations in PaperCut NG/MF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 1.3%
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
PaperCut · PaperCut NG, PaperCut MFRelated CVEs — PaperCut NG, PaperCut MF
In the same product, most dangerous first.
CVE-2024-1222HIGHIncorrect authorization controls in PaperCut NG/MF APIsEPSS 64.0%CVE-2024-1883MEDIUMReflected XSS in PaperCut NG/MFEPSS 61.5%CVE-2024-1884MEDIUMServer Side Request Forgery in PaperCut NG/MFEPSS 37.9%CVE-2024-1882HIGHServer-side resource injection in PaperCut NG/MFEPSS 1.4%CVE-2024-1221LOWImproper access controls on APIs on Linux and macOS in PaperCut NG/MFEPSS 0.5%CVE-2024-1223MEDIUMImproper authorization controls in PaperCut NG/MFEPSS 0.4%