CVE-2024-1221

Description

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.

CVSS v3.1 Score

3.1

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-76 CWE-76

Affected Products

Vendor	Product	Versions
papercut	papercut_mf	< 20.1.10
papercut	papercut_mf	21.0.0 — 21.2.14
papercut	papercut_mf	22.0.0 — 22.1.5
papercut	papercut_mf	23.0.1 — 23.0.7
papercut	papercut_ng	< 20.1.10
papercut	papercut_ng	21.0.0 — 21.2.14
papercut	papercut_ng	22.0.0 — 22.1.5
papercut	papercut_ng	23.0.1 — 23.0.7
apple	macos	All
linux	linux_kernel	All

References

Advisories & Patches

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Frequently Asked Questions

What is CVE-2024-1221? +

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers. It has a CVSS v3.1 base score of 3.1 (LOW).

How severe is CVE-2024-1221? +

CVE-2024-1221 has a CVSS v3.1 score of 3.1 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-1221? +

CVE-2024-1221 affects products from apple, linux, papercut, specifically: linux_kernel, macos, papercut_mf, papercut_ng. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1221? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-2952 9.8

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing …

CVE-2024-34359 9.6

llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency …

CVE-2024-4897 8.4

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. …

CVE-2026-11311 8.1

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX …

CVE-2024-1882 7.2

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code …

CVE-2024-21600 6.5

An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on …