This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.
Weakness
The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Papercut_mf | Papercut | * | 20.1.10 (excluding) |
| Papercut_mf | Papercut | 21.0.0 (including) | 21.2.14 (excluding) |
| Papercut_mf | Papercut | 22.0.0 (including) | 22.1.5 (excluding) |
| Papercut_mf | Papercut | 23.0.1 (including) | 23.0.7 (excluding) |
| Papercut_ng | Papercut | * | 20.1.10 (excluding) |
| Papercut_ng | Papercut | 21.0.0 (including) | 21.2.14 (excluding) |
| Papercut_ng | Papercut | 22.0.0 (including) | 22.1.5 (excluding) |
| Papercut_ng | Papercut | 23.0.1 (including) | 23.0.7 (excluding) |