CVE-2024-1222

Published: Mar 14, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.

Affected (8)

Products: Papercut: Papercut Mf, Papercut Ng

Papercut

2 products

Papercut Mf

Papercut Ng

Configuration A

8 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Papercut Papercut Mf	Before 20.1.10
Papercut Papercut Mf	From 21.0.0 to 21.2.14
Papercut Papercut Mf	From 22.0.0 to 22.1.5
Papercut Papercut Mf	From 23.0.1 to 23.0.7
Papercut Papercut Ng	Before 20.1.10
Papercut Papercut Ng	From 21.0.0 to 21.2.14
Papercut Papercut Ng	From 22.0.0 to 22.1.5
Papercut Papercut Ng	From 23.0.1 to 23.0.7

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Related CWEs

CWE-250

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (2)

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Source: eb41dac7-0af8-4f84-9f6d-0272772514f4

Vendor Advisory

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.