VulnerabilityAnalyzed

CVE-2024-1223

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs.

MEDIUM 4.8EPSS 0.45%

Does this matter?

Lower severity and a low EPSS score (0.45%). Track it; it rarely justifies an emergency change on its own.

Description

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-488
Affected: papercut/papercut mf · papercut/papercut ng
Source: eb41dac7-0af8-4f84-9f6d-0272772514f4

References

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.