CVE-2024-1221

Published: Mar 14, 2024Modified: Jun 17, 2026

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: NVD

Description

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.

Affected (8)

Products: Papercut: Papercut Mf, Papercut Ng

Papercut

2 products

Papercut Mf

Papercut Ng

Configuration A

8 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Papercut Papercut Mf	Before 20.1.10
Papercut Papercut Mf	From 21.0.0 to 21.2.14
Papercut Papercut Mf	From 22.0.0 to 22.1.5
Papercut Papercut Mf	From 23.0.1 to 23.0.7
Papercut Papercut Ng	Before 20.1.10
Papercut Papercut Ng	From 21.0.0 to 21.2.14
Papercut Papercut Ng	From 22.0.0 to 22.1.5
Papercut Papercut Ng	From 23.0.1 to 23.0.7

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions

Related CWEs

CWE-76

Improper Neutralization of Equivalent Special Elements

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

References (2)

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Source: eb41dac7-0af8-4f84-9f6d-0272772514f4

Vendor Advisory

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.