CVE-2024-8405: Arbitrary File Creation in PaperCut NG/MF Web Print leading to a Denial of Service attack
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack.
Note:
This CVE has been split from CVE-2024-4712.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8405?
CVE-2024-8405 is considered a critical vulnerability due to the potential for arbitrary file creation on affected systems.
How do I fix CVE-2024-8405?
To fix CVE-2024-8405, update PaperCut NG or MF to version 23.0.9 or later.
Which systems are affected by CVE-2024-8405?
CVE-2024-8405 affects Windows servers running PaperCut NG or MF with Web Print enabled.
What is the impact of CVE-2024-8405?
The impact of CVE-2024-8405 allows attackers to create arbitrary files on the server, potentially leading to further exploitation.
Is there a workaround for CVE-2024-8405?
As a workaround for CVE-2024-8405, it is recommended to disable the Web Print feature until the software is updated.