CVE-2024-1222— Incorrect authorization controls in PaperCut NG/MF APIs
Quick assessment
Affected
PaperCut PaperCut NG, PaperCut MF
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PaperCut NG是澳大利亚PaperCut公司的一套下一代打印机控制软件。 PaperCut NG/MF存在安全漏洞，该漏洞源于存在权限提升漏洞。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-1222
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect authorization controls in PaperCut NG/MF APIs
Source: CVE Program / CVE List V5
Vulnerability Description
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
带着不必要的权限执行
Source: CVE Program / CVE List V5
Vulnerability Title
PaperCut NG 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PaperCut NG是澳大利亚PaperCut公司的一套下一代打印机控制软件。 PaperCut NG/MF存在安全漏洞，该漏洞源于存在权限提升漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PaperCut | PaperCut NG, PaperCut MF | 0 ~ 23.0.7 | - |
|
II. Public POCs for CVE-2024-1222
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-1222
请登录查看更多情报信息。
Other References for CVE-2024-1222 (1)
Same Patch Batch · PaperCut · 2024-03-14 · 7 CVEs total
| CVE-2024-1654 | 7.2 HIGH | Unauthorized write operations in PaperCut NG/MF |
| CVE-2024-1882 | 7.2 HIGH | Server-side resource injection in PaperCut NG/MF |
| CVE-2024-1884 | 6.5 MEDIUM | Server Side Request Forgery in PaperCut NG/MF |
| CVE-2024-1883 | 6.3 MEDIUM | Reflected XSS in PaperCut NG/MF |
| CVE-2024-1223 | 4.8 MEDIUM | Improper authorization controls in PaperCut NG/MF |
| CVE-2024-1221 | 3.1 LOW | Improper access controls on APIs on Linux and macOS in PaperCut NG/MF |
IV. Related Vulnerabilities
Same product: PaperCut NG, PaperCut MF
-
CVE-2024-8404
Arbitrary File Deletion in PaperCut NG/MF Web Print Hot fold -
CVE-2024-8405
Arbitrary File Creation in PaperCut NG/MF Web Print leading -
CVE-2024-4712
Arbitrary File Creation in PaperCut NG/MF Web Print Image Ha -
CVE-2024-3037
Arbitrary File Deletion in PaperCut NG/MF Web Print -
CVE-2024-1884
Server Side Request Forgery in PaperCut NG/MF
Same vendor: PaperCut
-
CVE-2026-11744
PaperCut Hive Embedded App for Ricoh: Javascript injection -
CVE-2026-87739
PaperCut MF/NG: User permissions are not evaluated on report -
CVE-2026-82077
PaperCut NG/MF: Remote Code Execution via Scan2Fax -
CVE-2026-14780
PaperCut NG/MF: Remote Code Execution via Scripting Subsyste -
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Con
Same weakness: CWE-250
-
CVE-2026-66246
HCL iControl is affected by multiple security vulnerabilitie -
CVE-2026-53605
Reachy Mini Wireless: Local Privilege Escalation via Unrestr -
CVE-2026-102247
FastAdmin Database Management database.php unnecessary privi -
CVE-2026-88808
Fleet agent copies downstream resources with cluster-admin p -
CVE-2026-87899
cPanel提权漏洞：远程用户可获Root权限执行代码
V. Comments for CVE-2024-1222
No comments yet