CVE-2024-1654

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2024-03-14 03:15

Updated : 2025-01-23 20:29

NVD link : CVE-2024-1654

Mitre link : CVE-2024-1654

CVE.ORG link : CVE-2024-1654

JSON object : View

Products Affected

papercut

papercut_ng
papercut_mf

microsoft

windows

linux

linux_kernel

apple

macos

CWE

CWE-183

Permissive List of Allowed Inputs

NVD-CWE-Other

{"id": "CVE-2024-1654", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-03-14T03:15:08.033", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["Vendor Advisory"], "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}, {"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "description": [{"lang": "en", "value": "CWE-183"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. "}, {"lang": "es", "value": "Esta vulnerabilidad permite potencialmente operaciones de escritura no autorizadas que pueden conducir a la ejecuci\u00f3n remota de c\u00f3digo. Un atacante ya debe tener acceso de administrador autenticado y conocimiento tanto de un identificador interno del sistema como de los detalles de otro usuario v\u00e1lido para explotar esto."}], "lastModified": "2025-01-23T20:29:56.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87E57A99-6580-4C5D-AD49-2C77153698B5", "versionEndExcluding": "20.1.10"}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC862C5A-C51D-455A-BA4C-62AF4B5593D6", "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B444455-3DE9-4268-AED3-9457016B833F", "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06311316-1937-41A4-BEE2-57F7C4F6B6BC", "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7A1BAB4-D3AC-4A06-B2AB-E46DED8CB19D", "versionEndExcluding": "20.1.10"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "570DCFBC-7689-4E77-A8BF-8F310545EDE3", "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "728ECAA8-FE3E-4F6D-8862-AF0C100C6699", "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7155AC1E-E4C8-4EF5-B593-7C924AF0C625", "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}