Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

PaperCut NG/MF

Unknown

Source

eb41dac7-0af8-4f84-9f6d-0272772514f4

CVE-2024-8405 details

Published : Sept. 26, 2024, 2:15 a.m.
Last Modified : Sept. 26, 2024, 1:32 p.m.

Description

An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712.

CVSS Score

1	2	3	4	5	6.1	7	8	9	10

Weakness

Weakness	Name	Description
CWE-77	Improper Neutralization of Special Elements used in a Command ('Command Injection')	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

Base Score

6.1

Exploitability Score

1.8

Impact Score

4.2

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

URL	Source
https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/	eb41dac7-0af8-4f84-9f6d-0272772514f4

This website uses the NVD API, but is not approved or certified by it.

CVE-2024-8405