CVE-2024-1223: Improper authorization controls in PaperCut NG/MF
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1223?
The vulnerability CVE-2024-1223 is classified as a medium severity issue allowing unauthorized information enumeration from embedded device APIs.
How do I fix CVE-2024-1223?
To fix CVE-2024-1223, update your PaperCut NG or MF software to the latest version as recommended by the vendor.
Which versions of PaperCut NG/MF are affected by CVE-2024-1223?
CVE-2024-1223 affects PaperCut NG/MF versions prior to 20.1.10 and between 21.0.0 to 23.0.7.
What type of attack can exploit CVE-2024-1223?
An attacker can exploit CVE-2024-1223 by leveraging existing knowledge of valid usernames, device names, and internal system keys.
Is there a potential risk of data exposure with CVE-2024-1223?
Yes, CVE-2024-1223 poses a risk of unauthorized data exposure from the targeting of embedded device APIs.