CVEvulnerability

CVE-2024-1223

4.8 MEDIUM Published 2024-03-14 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-03-14
Last modified
2026-06-17
Assigner
eb41dac7-0af8-4f84-9f6d-0272772514f4
CVSS 3.1 (eb41dac7-0af8-4f84-9f6d-0272772514f4)
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-488

Description

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.

Affected configurations

• papercut papercut mf (< 20.1.10) • papercut papercut mf (>= 21.0.0 < 21.2.14) • papercut papercut mf (>= 22.0.0 < 22.1.5) • papercut papercut mf (>= 23.0.1 < 23.0.7) • papercut papercut ng (< 20.1.10) • papercut papercut ng (>= 21.0.0 < 21.2.14) • papercut papercut ng (>= 22.0.0 < 22.1.5) • papercut papercut ng (>= 23.0.1 < 23.0.7)

Related

Weakness · CWE (1)

  • CWE-488 Exposure of Data Element to Wrong Session weakness

References