2 lines
3.8 KiB
JSON
2 lines
3.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Web Print"],"platforms":["Windows"],"product":"PaperCut NG, PaperCut MF","vendor":"PaperCut","versions":[{"changes":[{"at":"23.0.9","status":"unaffected"}],"lessThan":"23.0.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*","matchCriteriaId":"7AE8A9B5-11C6-4FE2-B672-0EC6EF8075CC","versionEndExcluding":"23.0.9","vulnerable":true},{"criteria":"cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*","matchCriteriaId":"BA96610E-7518-4215-B5FF-1B4444BE2DA4","versionEndExcluding":"23.0.9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the image-handler process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can lead to local privilege escalation.\n\nNote: \n\nThis CVE has been split into two (CVE-2024-4712 and CVE-2024-8405) and it’s been rescored with a \"Privileges Required (PR)\" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server."},{"lang":"es","value":"Existe una vulnerabilidad de creación de archivos arbitraria en PaperCut NG/MF que solo afecta a los servidores Windows con Web Print habilitado. Esta vulnerabilidad requiere inicio de sesión local/acceso a la consola del servidor PaperCut NG/MF (por ejemplo: miembro de un grupo de administración de dominio)."}],"id":"CVE-2024-4712","lastModified":"2026-06-17T08:02:27.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-06-20T19:40:02.500241Z","version":"2.0.3"}}]},"published":"2024-05-14T15:44:27.660","references":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","tags":["Vendor Advisory"],"url":"https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.papercut.com/kb/Main/security-bulletin-may-2024/"}],"sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
|