FKIE_CVE-2024-1223

Vulnerability from fkie_nvd - Published: 2024-03-14 03:15 - Updated: 2025-01-23 20:29
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.
References
eb41dac7-0af8-4f84-9f6d-0272772514f4https://www.papercut.com/kb/Main/Security-Bulletin-March-2024Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.papercut.com/kb/Main/Security-Bulletin-March-2024Vendor Advisory
Impacted products
Vendor Product Version
papercut papercut_mf *
papercut papercut_mf *
papercut papercut_mf *
papercut papercut_mf *
papercut papercut_ng *
papercut papercut_ng *
papercut papercut_ng *
papercut papercut_ng *
apple macos -
linux linux_kernel -
microsoft windows -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "87E57A99-6580-4C5D-AD49-2C77153698B5",
              "versionEndExcluding": "20.1.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC862C5A-C51D-455A-BA4C-62AF4B5593D6",
              "versionEndExcluding": "21.2.14",
              "versionStartIncluding": "21.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B444455-3DE9-4268-AED3-9457016B833F",
              "versionEndExcluding": "22.1.5",
              "versionStartIncluding": "22.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "06311316-1937-41A4-BEE2-57F7C4F6B6BC",
              "versionEndExcluding": "23.0.7",
              "versionStartIncluding": "23.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7A1BAB4-D3AC-4A06-B2AB-E46DED8CB19D",
              "versionEndExcluding": "20.1.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "570DCFBC-7689-4E77-A8BF-8F310545EDE3",
              "versionEndExcluding": "21.2.14",
              "versionStartIncluding": "21.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "728ECAA8-FE3E-4F6D-8862-AF0C100C6699",
              "versionEndExcluding": "22.1.5",
              "versionStartIncluding": "22.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7155AC1E-E4C8-4EF5-B593-7C924AF0C625",
              "versionEndExcluding": "23.0.7",
              "versionStartIncluding": "23.0.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite potencialmente la enumeraci\u00f3n no autorizada de informaci\u00f3n de las API del dispositivo integrado. Un atacante ya debe tener conocimiento de alguna combinaci\u00f3n de nombres de usuario v\u00e1lidos, nombres de dispositivos y una clave interna del sistema. Para que un ataque de este tipo tenga \u00e9xito, el sistema debe estar en un estado de ejecuci\u00f3n espec\u00edfico."
    }
  ],
  "id": "CVE-2024-1223",
  "lastModified": "2025-01-23T20:29:14.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-03-14T03:15:07.580",
  "references": [
    {
      "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024"
    }
  ],
  "sourceIdentifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ],
      "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.