CVE-2024-1882 - Vulnerability Details

Vendors	Products
Apple	Macos
Linux	Linux Kernel
Microsoft	Windows
Papercut	Papercut Mf Papercut Ng

Link	Providers
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows

Type	Values Removed	Values Added
First Time appeared		Papercut Papercut papercut Mf Papercut papercut Ng
Weaknesses	CWE-74
CPEs		cpe:2.3:a:papercut:papercut_mf:::::::: cpe:2.3:a:papercut:papercut_ng::::::::
Vendors & Products		Papercut Papercut papercut Mf Papercut papercut Ng
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description	This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.	This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.
Weaknesses		CWE-76

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1882", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "state": "PUBLISHED", "assignerShortName": "PaperCut", "dateReserved": "2024-02-26T05:36:21.950Z", "datePublished": "2024-03-14T03:08:17.914Z", "dateUpdated": "2024-09-26T03:52:57.154Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["MacOS", "Linux", "Windows"], "product": "PaperCut NG, PaperCut MF", "vendor": "PaperCut", "versions": [{"changes": [{"at": "23.0.7", "status": "unaffected"}], "lessThan": "23.0.7", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "22.1.5", "status": "unaffected"}], "lessThan": "22.1.5", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "21.2.14", "status": "unaffected"}], "lessThan": "21.2.14", "status": "affected", "version": "0", "versionType": "custom"}, {"changes": [{"at": "20.1.10", "status": "unaffected"}], "lessThan": "20.1.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.<br>"}], "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-76", "description": "CWE-76 Improper Neutralization of Equivalent Special Elements", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-09-26T03:52:57.154Z"}, "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "source": {"discovery": "UNKNOWN"}, "title": "Server-side resource injection in PaperCut NG/MF", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "papercut", "product": "papercut_ng", "cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}, {"vendor": "papercut", "product": "papercut_mf", "cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "23.0.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "22.1.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "21.2.14", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "20.1.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-16T04:00:55.398174Z", "id": "CVE-2024-1882", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T16:02:52.603Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:56:22.441Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-1882 (string)

assignerOrgId : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

state : PUBLISHED (string)

assignerShortName : PaperCut (string)

dateReserved : 2024-02-26T05:36:21.950Z (string)

datePublished : 2024-03-14T03:08:17.914Z (string)

dateUpdated : 2024-09-26T03:52:57.154Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : affected (string)

platforms : [ »

0 : MacOS (string)

1 : Linux (string)

2 : Windows (string)

]

product : PaperCut NG, PaperCut MF (string)

vendor : PaperCut (string)

versions : [ »

0 : { »

changes : [ »

0 : { »

at : 23.0.7 (string)

status : unaffected (string)

}

]

lessThan : 23.0.7 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

1 : { »

changes : [ »

0 : { »

at : 22.1.5 (string)

status : unaffected (string)

}

]

lessThan : 22.1.5 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

2 : { »

changes : [ »

0 : { »

at : 21.2.14 (string)

status : unaffected (string)

}

]

lessThan : 21.2.14 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

3 : { »

changes : [ »

0 : { »

at : 20.1.10 (string)

status : unaffected (string)

}

]

lessThan : 20.1.10 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.<br> (string)

}

]

value : This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-253 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-253 Remote Code Inclusion (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-76 (string)

description : CWE-76 Improper Neutralization of Equivalent Special Elements (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

shortName : PaperCut (string)

dateUpdated : 2024-09-26T03:52:57.154Z (string)

}

references : [ »

0 : { »

url : https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Server-side resource injection in PaperCut NG/MF (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : papercut (string)

product : papercut_ng (string)

cpes : [ »

0 : cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 23.0.7 (string)

versionType : custom (string)

}

1 : { »

version : 0 (string)

status : affected (string)

lessThan : 22.1.5 (string)

versionType : custom (string)

}

2 : { »

version : 0 (string)

status : affected (string)

lessThan : 21.2.14 (string)

versionType : custom (string)

}

3 : { »

version : 0 (string)

status : affected (string)

lessThan : 20.1.10 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : papercut (string)

product : papercut_mf (string)

cpes : [ »

0 : cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* (string)

]

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 23.0.7 (string)

versionType : custom (string)

}

1 : { »

version : 0 (string)

status : affected (string)

lessThan : 22.1.5 (string)

versionType : custom (string)

}

2 : { »

version : 0 (string)

status : affected (string)

lessThan : 21.2.14 (string)

versionType : custom (string)

}

3 : { »

version : 0 (string)

status : affected (string)

lessThan : 20.1.10 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-03-16T04:00:55.398174Z (string)

id : CVE-2024-1882 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-07-25T16:02:52.603Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:56:22.441Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:56:22.441Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-16T04:00:55.398174Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_ng", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*"], "vendor": "papercut", "product": "papercut_mf", "versions": [{"status": "affected", "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T16:02:47.164Z"}}], "cna": {"title": "Server-side resource injection in PaperCut NG/MF", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PaperCut", "product": "PaperCut NG, PaperCut MF", "versions": [{"status": "affected", "changes": [{"at": "23.0.7", "status": "unaffected"}], "version": "0", "lessThan": "23.0.7", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "22.1.5", "status": "unaffected"}], "version": "0", "lessThan": "22.1.5", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "21.2.14", "status": "unaffected"}], "version": "0", "lessThan": "21.2.14", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "20.1.10", "status": "unaffected"}], "version": "0", "lessThan": "20.1.10", "versionType": "custom"}], "platforms": ["MacOS", "Linux", "Windows"], "defaultStatus": "affected"}], "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.", "supportingMedia": [{"type": "text/html", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-76", "description": "CWE-76 Improper Neutralization of Equivalent Special Elements"}]}], "providerMetadata": {"orgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "shortName": "PaperCut", "dateUpdated": "2024-09-26T03:52:57.154Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1882", "state": "PUBLISHED", "dateUpdated": "2024-09-26T03:52:57.154Z", "dateReserved": "2024-02-26T05:36:21.950Z", "assignerOrgId": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "datePublished": "2024-03-14T03:08:17.914Z", "assignerShortName": "PaperCut"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:56:22.441Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-1882 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-03-16T04:00:55.398174Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* (string)

]

vendor : papercut (string)

product : papercut_ng (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 23.0.7 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 0 (string)

lessThan : 22.1.5 (string)

versionType : custom (string)

}

2 : { »

status : affected (string)

version : 0 (string)

lessThan : 21.2.14 (string)

versionType : custom (string)

}

3 : { »

status : affected (string)

version : 0 (string)

lessThan : 20.1.10 (string)

versionType : custom (string)

}

]

defaultStatus : affected (string)

}

1 : { »

cpes : [ »

0 : cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* (string)

]

vendor : papercut (string)

product : papercut_mf (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 23.0.7 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 0 (string)

lessThan : 22.1.5 (string)

versionType : custom (string)

}

2 : { »

status : affected (string)

version : 0 (string)

lessThan : 21.2.14 (string)

versionType : custom (string)

}

3 : { »

status : affected (string)

version : 0 (string)

lessThan : 20.1.10 (string)

versionType : custom (string)

}

]

defaultStatus : affected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-07-25T16:02:47.164Z (string)

}

]

cna : { »

title : Server-side resource injection in PaperCut NG/MF (string)

source : { »

discovery : UNKNOWN (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-253 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-253 Remote Code Inclusion (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.2 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : HIGH (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : PaperCut (string)

product : PaperCut NG, PaperCut MF (string)

versions : [ »

0 : { »

status : affected (string)

changes : [ »

0 : { »

at : 23.0.7 (string)

status : unaffected (string)

}

]

version : 0 (string)

lessThan : 23.0.7 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

changes : [ »

0 : { »

at : 22.1.5 (string)

status : unaffected (string)

}

]

version : 0 (string)

lessThan : 22.1.5 (string)

versionType : custom (string)

}

2 : { »

status : affected (string)

changes : [ »

0 : { »

at : 21.2.14 (string)

status : unaffected (string)

}

]

version : 0 (string)

lessThan : 21.2.14 (string)

versionType : custom (string)

}

3 : { »

status : affected (string)

changes : [ »

0 : { »

at : 20.1.10 (string)

status : unaffected (string)

}

]

version : 0 (string)

lessThan : 20.1.10 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : MacOS (string)

1 : Linux (string)

2 : Windows (string)

]

defaultStatus : affected (string)

}

]

references : [ »

0 : { »

url : https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-76 (string)

description : CWE-76 Improper Neutralization of Equivalent Special Elements (string)

}

]

}

]

providerMetadata : { »

orgId : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

shortName : PaperCut (string)

dateUpdated : 2024-09-26T03:52:57.154Z (string)

}

cveMetadata : { »

cveId : CVE-2024-1882 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-26T03:52:57.154Z (string)

dateReserved : 2024-02-26T05:36:21.950Z (string)

assignerOrgId : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

datePublished : 2024-03-14T03:08:17.914Z (string)

assignerShortName : PaperCut (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "matchCriteriaId": "87E57A99-6580-4C5D-AD49-2C77153698B5", "versionEndExcluding": "20.1.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC862C5A-C51D-455A-BA4C-62AF4B5593D6", "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B444455-3DE9-4268-AED3-9457016B833F", "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "matchCriteriaId": "06311316-1937-41A4-BEE2-57F7C4F6B6BC", "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7A1BAB4-D3AC-4A06-B2AB-E46DED8CB19D", "versionEndExcluding": "20.1.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "matchCriteriaId": "570DCFBC-7689-4E77-A8BF-8F310545EDE3", "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "matchCriteriaId": "728ECAA8-FE3E-4F6D-8862-AF0C100C6699", "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "matchCriteriaId": "7155AC1E-E4C8-4EF5-B593-7C924AF0C625", "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server."}, {"lang": "es", "value": "Esta vulnerabilidad permite que un usuario administrador ya autenticado cree un payload malicioso que podr\u00eda aprovecharse para la ejecuci\u00f3n remota de c\u00f3digo en el servidor que aloja el servidor de aplicaciones PaperCut NG/MF."}], "id": "CVE-2024-1882", "lastModified": "2025-01-23T20:30:14.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-14T04:15:08.003", "references": [{"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "tags": ["Vendor Advisory"], "url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"}], "sourceIdentifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-76"}], "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 87E57A99-6580-4C5D-AD49-2C77153698B5 (string)

versionEndExcluding : 20.1.10 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* (string)

matchCriteriaId : AC862C5A-C51D-455A-BA4C-62AF4B5593D6 (string)

versionEndExcluding : 21.2.14 (string)

versionStartIncluding : 21.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3B444455-3DE9-4268-AED3-9457016B833F (string)

versionEndExcluding : 22.1.5 (string)

versionStartIncluding : 22.0.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 06311316-1937-41A4-BEE2-57F7C4F6B6BC (string)

versionEndExcluding : 23.0.7 (string)

versionStartIncluding : 23.0.1 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F7A1BAB4-D3AC-4A06-B2AB-E46DED8CB19D (string)

versionEndExcluding : 20.1.10 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 570DCFBC-7689-4E77-A8BF-8F310545EDE3 (string)

versionEndExcluding : 21.2.14 (string)

versionStartIncluding : 21.0.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 728ECAA8-FE3E-4F6D-8862-AF0C100C6699 (string)

versionEndExcluding : 22.1.5 (string)

versionStartIncluding : 22.0.0 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7155AC1E-E4C8-4EF5-B593-7C924AF0C625 (string)

versionEndExcluding : 23.0.7 (string)

versionStartIncluding : 23.0.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 387021A0-AF36-463C-A605-32EA7DAC172E (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 703AF700-7A70-47E2-BC3A-7FD03B3CA9C1 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2572D17-1DE6-457B-99CC-64AFD54487EA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server. (string)

}

1 : { »

lang : es (string)

value : Esta vulnerabilidad permite que un usuario administrador ya autenticado cree un payload malicioso que podría aprovecharse para la ejecución remota de código en el servidor que aloja el servidor de aplicaciones PaperCut NG/MF. (string)

}

]

id : CVE-2024-1882 (string)

lastModified : 2025-01-23T20:30:14.080 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-03-14T04:15:08.003 (string)

references : [ »

0 : { »

source : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 (string)

}

]

sourceIdentifier : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-76 (string)

}

]

source : eb41dac7-0af8-4f84-9f6d-0272772514f4 (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-Other (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object