CVE-2024-1654 - OpenCVE

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

History

No history.

MITRE

Status: PUBLISHED

Assigner: PaperCut

Published: 2024-03-14T03:06:54.867Z

Updated: 2024-08-01T18:48:21.853Z

Reserved: 2024-02-20T02:23:09.252Z

Link: CVE-2024-1654

Vulnrichment

Updated: 2024-08-01T18:48:21.853Z

NVD

Status : Awaiting Analysis

Published: 2024-03-14T03:15:08.033

Modified: 2024-03-14T12:52:09.877

Link: CVE-2024-1654

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1654", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "state": "PUBLISHED", "assignerShortName": "PaperCut", "dateReserved": "2024-02-20T02:23:09.252Z", "datePublished": "2024-03-14T03:06:54.867Z", "dateUpdated": "2024-08-01T18:48:21.853Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["MacOS", "Linux", "Windows"], "product": "PaperCut NG, PaperCut MF", "vendor": "PaperCut", "versions": [{"changes": [{"at": "23.0.7", "status": "unaffected"}], "lessThan": "23.0.7", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "22.1.5", "status": "unaffected"}], "lessThan": "22.1.5", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "21.2.14", "status": "unaffected"}], "lessThan": "21.2.14", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "20.1.10", "status": "unaffected"}], "lessThan": "20.1.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. "}], "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. "}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-183", "description": "CWE-183 Permissive List of Allowed Inputs", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-03-14T03:06:54.867Z"}, "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "source": {"discovery": "UNKNOWN"}, "title": "Unauthorized write operations in PaperCut NG/MF", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "papercut", "product": "papercut_mf", "cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}, {"vendor": "papercut", "product": "papercut_ng", "cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-16T04:00:54.272578Z", "id": "CVE-2024-1654", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T16:04:21.347Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.853Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.853Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1654", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-16T04:00:54.272578Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_mf", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_ng", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T16:04:13.165Z"}}], "cna": {"title": "Unauthorized write operations in PaperCut NG/MF", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PaperCut", "product": "PaperCut NG, PaperCut MF", "versions": [{"status": "affected", "changes": [{"at": "23.0.7", "status": "unaffected"}], "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "22.1.5", "status": "unaffected"}], "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "21.2.14", "status": "unaffected"}], "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "20.1.10", "status": "unaffected"}], "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "platforms": ["MacOS", "Linux", "Windows"], "defaultStatus": "affected"}], "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. ", "supportingMedia": [{"type": "text/html", "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-183", "description": "CWE-183 Permissive List of Allowed Inputs"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-03-14T03:06:54.867Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1654", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:48:21.853Z", "dateReserved": "2024-02-20T02:23:09.252Z", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "datePublished": "2024-03-14T03:06:54.867Z", "assignerShortName": "PaperCut"}, "dataVersion": "5.1"}