CVE-2024-1222: Incorrect authorization controls in PaperCut NG/MF APIs
First published: Thu Mar 14 2024(Updated: )
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
Credit: eb41dac7-0af8-4f84-9f6d-0272772514f4
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| PaperCut NG | <20.1.10 | |
| PaperCut NG | >=21.0.0<21.2.14 | |
| PaperCut NG | >=22.0.0<22.1.5 | |
| PaperCut NG | >=23.0.1<23.0.7 | |
| PaperCut NG | <20.1.10 | |
| PaperCut NG | >=21.0.0<21.2.14 | |
| PaperCut NG | >=22.0.0<22.1.5 | |
| PaperCut NG | >=23.0.1<23.0.7 | |
| Any of | ||
| Apple iOS and macOS | ||
| Linux kernel | ||
| Microsoft Windows | ||
| PaperCut NG |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-1222?
CVE-2024-1222 has been rated with a significant severity because it allows unauthorized access to elevated API privileges.
How do I fix CVE-2024-1222?
To mitigate CVE-2024-1222, users should update to the latest patched version of PaperCut NG/MF software.
Which versions of PaperCut NG/MF are affected by CVE-2024-1222?
CVE-2024-1222 affects PaperCut NG from version 20.1.10 and various versions up to 23.0.7, as well as PaperCut MF in similar ranges.
What type of attack is enabled by CVE-2024-1222?
CVE-2024-1222 enables attackers to exploit malformed API requests for unauthorized elevated access.
Is there a workaround for CVE-2024-1222 before applying a patch?
No formal workarounds have been provided for CVE-2024-1222; the recommended action is to apply the available updates.
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/description
- agent/source
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/guess-ai
- vendor/papercut
- canonical/papercut ng
- version/papercut ng/21.0.0
- version/papercut ng/22.0.0
- version/papercut ng/23.0.1
- vendor/apple
- canonical/apple ios and macos
- vendor/linux
- canonical/linux kernel
- vendor/microsoft
- canonical/microsoft windows