CVE-2024-1223: This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames,...

Summary

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a s...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
papercut	papercut_mf	< 20.1.10 >= 21.0.0, < 21.2.14 >= 22.0.0, < 22.1.5 >= 23.0.1, < 23.0.7 `cpe:2.3:a:papercut:papercut_mf::::::::`
papercut	papercut_ng	< 20.1.10 >= 21.0.0, < 21.2.14 >= 22.0.0, < 22.1.5 >= 23.0.1, < 23.0.7 `cpe:2.3:a:papercut:papercut_ng::::::::`

Original advisory text

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames,...

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.

References

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024 Vendor Advisory