CVE-2024-8405
Medium
Description
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Papercut Mf
PublishedSep 26, 2024
First seenSep 26, 2024
Weakness typeCWE-77Command injection
How to fix
Update
- papercut papercut_mf23.0.9 or later
- papercut papercut_ng23.0.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| papercut papercut_mf | v < 23.0.9 | 23.0.9 |
| papercut papercut_ng | v < 23.0.9 | 23.0.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.