CVE-2024-1654

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_mf::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::
	cpe:2.3:a:papercut:papercut_ng::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

23 Jan 2025, 20:29

Type	Values Removed	Values Added
CPE		cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:a:papercut:papercut_mf:::::::: cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:papercut:papercut_ng::::::::
References	~~() https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 -~~	() https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 - Vendor Advisory
CWE		NVD-CWE-Other
First Time		Microsoft Papercut Linux Apple macos Microsoft windows Papercut papercut Ng Linux linux Kernel Papercut papercut Mf Apple

Information

Published : 2024-03-14 03:15

Updated : 2025-01-23 20:29

NVD link : CVE-2024-1654

Mitre link : CVE-2024-1654

CVE.ORG link : CVE-2024-1654

JSON object : View

Products Affected

apple

macos

papercut

papercut_ng
papercut_mf

linux

linux_kernel

microsoft

windows

CWE

CWE-183

Permissive List of Allowed Inputs

NVD-CWE-Other

{"id": "CVE-2024-1654", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-03-14T03:15:08.033", "references": [{"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["Vendor Advisory"], "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}, {"url": "https://www.papercut.com/kb/Main/Security-Bulletin-March-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "description": [{"lang": "en", "value": "CWE-183"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this. "}, {"lang": "es", "value": "Esta vulnerabilidad permite potencialmente operaciones de escritura no autorizadas que pueden conducir a la ejecuci\u00f3n remota de c\u00f3digo. Un atacante ya debe tener acceso de administrador autenticado y conocimiento tanto de un identificador interno del sistema como de los detalles de otro usuario v\u00e1lido para explotar esto."}], "lastModified": "2025-01-23T20:29:56.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87E57A99-6580-4C5D-AD49-2C77153698B5", "versionEndExcluding": "20.1.10"}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC862C5A-C51D-455A-BA4C-62AF4B5593D6", "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B444455-3DE9-4268-AED3-9457016B833F", "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06311316-1937-41A4-BEE2-57F7C4F6B6BC", "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7A1BAB4-D3AC-4A06-B2AB-E46DED8CB19D", "versionEndExcluding": "20.1.10"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "570DCFBC-7689-4E77-A8BF-8F310545EDE3", "versionEndExcluding": "21.2.14", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "728ECAA8-FE3E-4F6D-8862-AF0C100C6699", "versionEndExcluding": "22.1.5", "versionStartIncluding": "22.0.0"}, {"criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7155AC1E-E4C8-4EF5-B593-7C924AF0C625", "versionEndExcluding": "23.0.7", "versionStartIncluding": "23.0.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}