Main Vulnerability Database Vulnerabilities #VU87606

Server-Side Request Forgery (SSRF) in PaperCut NG and PaperCut MF - CVE-2024-1884

Published: March 19, 2024 / Updated: June 19, 2024

Vulnerability identifier: #VU87606

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2024-1884

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Affected software

PaperCut NG
PaperCut MF

How to mitigate CVE-2024-1884

Install updates from vendor's website.

PaperCut NG - addressed in versions 20.1.10, 21.2.14, 22.1.5, 23.0.7
PaperCut MF - addressed in versions 20.1.10, 21.2.14, 22.1.5, 23.0.7

External References

Related Security Bulletins