OpenCVE

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Papercut	Papercut Mf Papercut Ng

No data.

No data.

References

Link	Providers
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

History

Thu, 26 Sep 2024 04:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Papercut Papercut papercut Mf Papercut papercut Ng
Weaknesses	CWE-200
CPEs		cpe:2.3:a:papercut:papercut_mf:::::::: cpe:2.3:a:papercut:papercut_ng::::::::
Vendors & Products		Papercut Papercut papercut Mf Papercut papercut Ng
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 26 Sep 2024 04:00:00 +0000

Type	Values Removed	Values Added
Description	This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.	This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
Weaknesses		CWE-250

MITRE

Status: PUBLISHED

Assigner: PaperCut

Published: 2024-03-14T03:03:18.638Z

Updated: 2024-09-26T03:50:54.624Z

Reserved: 2024-02-05T04:34:00.207Z

Link: CVE-2024-1222

Vulnrichment

Updated: 2024-08-01T18:33:25.592Z

NVD

Status : Awaiting Analysis

Published: 2024-03-14T03:15:07.090

Modified: 2024-11-21T08:50:05.110

Link: CVE-2024-1222

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1222", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "state": "PUBLISHED", "assignerShortName": "PaperCut", "dateReserved": "2024-02-05T04:34:00.207Z", "datePublished": "2024-03-14T03:03:18.638Z", "dateUpdated": "2024-09-26T03:50:54.624Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["MacOS", "Linux", "Windows"], "product": "PaperCut NG, PaperCut MF", "vendor": "PaperCut", "versions": [{"changes": [{"at": "23.0.7", "status": "unaffected"}], "lessThan": "23.0.7", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "22.1.5", "status": "unaffected"}], "lessThan": "22.1.5", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "21.2.14", "status": "unaffected"}], "lessThan": "21.2.14", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "20.1.10", "status": "unaffected"}], "lessThan": "20.1.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.<br><br>"}], "value": "This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "description": "CWE-250: Execution with Unnecessary Privileges", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-09-26T03:50:54.624Z"}, "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "source": {"discovery": "UNKNOWN"}, "title": "Incorrect authorization controls in PaperCut NG/MF APIs", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:25.592Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "papercut", "product": "papercut_mf", "cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}, {"vendor": "papercut", "product": "papercut_ng", "cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-26T04:00:45.176980Z", "id": "CVE-2024-1222", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T15:10:56.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:25.592Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-26T04:00:45.176980Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_mf", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_ng", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T15:10:51.596Z"}}], "cna": {"title": "Incorrect authorization controls in PaperCut NG/MF APIs", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PaperCut", "product": "PaperCut NG, PaperCut MF", "versions": [{"status": "affected", "changes": [{"at": "23.0.7", "status": "unaffected"}], "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "22.1.5", "status": "unaffected"}], "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "21.2.14", "status": "unaffected"}], "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "20.1.10", "status": "unaffected"}], "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "platforms": ["MacOS", "Linux", "Windows"], "defaultStatus": "affected"}], "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.", "supportingMedia": [{"type": "text/html", "value": "This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250: Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-09-26T03:50:54.624Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1222", "state": "PUBLISHED", "dateUpdated": "2024-09-26T03:50:54.624Z", "dateReserved": "2024-02-05T04:34:00.207Z", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "datePublished": "2024-03-14T03:03:18.638Z", "assignerShortName": "PaperCut"}, "dataVersion": "5.1"}