CVE-2024-1882 - OpenCVE

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Papercut	Papercut Mf Papercut Ng

No data.

No data.

References

Link	Providers
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

History

Thu, 26 Sep 2024 04:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Papercut Papercut papercut Mf Papercut papercut Ng
Weaknesses	CWE-74
CPEs		cpe:2.3:a:papercut:papercut_mf:::::::: cpe:2.3:a:papercut:papercut_ng::::::::
Vendors & Products		Papercut Papercut papercut Mf Papercut papercut Ng
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 26 Sep 2024 04:00:00 +0000

Type	Values Removed	Values Added
Description	This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.	This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.
Weaknesses		CWE-76

MITRE

Status: PUBLISHED

Assigner: PaperCut

Published: 2024-03-14T03:08:17.914Z

Updated: 2024-09-26T03:52:57.154Z

Reserved: 2024-02-26T05:36:21.950Z

Link: CVE-2024-1882

Vulnrichment

Updated: 2024-08-01T18:56:22.441Z

NVD

Status : Awaiting Analysis

Published: 2024-03-14T04:15:08.003

Modified: 2024-09-26T04:15:07.377

Link: CVE-2024-1882

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1882", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "state": "PUBLISHED", "assignerShortName": "PaperCut", "dateReserved": "2024-02-26T05:36:21.950Z", "datePublished": "2024-03-14T03:08:17.914Z", "dateUpdated": "2024-09-26T03:52:57.154Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["MacOS", "Linux", "Windows"], "product": "PaperCut NG, PaperCut MF", "vendor": "PaperCut", "versions": [{"changes": [{"at": "23.0.7", "status": "unaffected"}], "lessThan": "23.0.7", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "22.1.5", "status": "unaffected"}], "lessThan": "22.1.5", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "21.2.14", "status": "unaffected"}], "lessThan": "21.2.14", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "20.1.10", "status": "unaffected"}], "lessThan": "20.1.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.<br>"}], "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-76", "description": "CWE-76 Improper Neutralization of Equivalent Special Elements", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-09-26T03:52:57.154Z"}, "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "source": {"discovery": "UNKNOWN"}, "title": "Server-side resource injection in PaperCut NG/MF", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "papercut", "product": "papercut_ng", "cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}, {"vendor": "papercut", "product": "papercut_mf", "cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-16T04:00:55.398174Z", "id": "CVE-2024-1882", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T16:02:52.603Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:56:22.441Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:56:22.441Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-16T04:00:55.398174Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_ng", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_mf", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T16:02:47.164Z"}}], "cna": {"title": "Server-side resource injection in PaperCut NG/MF", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PaperCut", "product": "PaperCut NG, PaperCut MF", "versions": [{"status": "affected", "changes": [{"at": "23.0.7", "status": "unaffected"}], "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "22.1.5", "status": "unaffected"}], "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "21.2.14", "status": "unaffected"}], "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "20.1.10", "status": "unaffected"}], "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "platforms": ["MacOS", "Linux", "Windows"], "defaultStatus": "affected"}], "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.", "supportingMedia": [{"type": "text/html", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-76", "description": "CWE-76 Improper Neutralization of Equivalent Special Elements"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-09-26T03:52:57.154Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1882", "state": "PUBLISHED", "dateUpdated": "2024-09-26T03:52:57.154Z", "dateReserved": "2024-02-26T05:36:21.950Z", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "datePublished": "2024-03-14T03:08:17.914Z", "assignerShortName": "PaperCut"}, "dataVersion": "5.1"}