CVE-2024-1654

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.

CVSS v3.0 7.2 HIGH

7.2^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

23 Jan 2025, 20:29

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:a:papercut:papercut_mf:::::::: cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:papercut:papercut_ng::::::::
First Time		Papercut Linux Microsoft windows Apple Linux linux Kernel Apple macos Papercut papercut Ng Microsoft Papercut papercut Mf
CWE		NVD-CWE-Other
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
References	~~() https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 -~~	() https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 - Vendor Advisory

14 Mar 2024, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-14 03:15

Updated : 2025-01-23 20:29

NVD link : CVE-2024-1654

Mitre link : CVE-2024-1654

JSON object : View

Products Affected

papercut

papercut_ng
papercut_mf

apple

macos

linux

linux_kernel

microsoft

windows

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "name": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "name": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. "}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-1654", "ASSIGNER": "security@papercut.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}}, "publishedDate": "2024-03-14T03:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "20.1.10"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "20.1.10"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0"}, {"cpe23Uri": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-01-23T20:29Z"}