This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
Weakness
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Papercut_mf | Papercut | * | 20.1.10 (excluding) |
| Papercut_mf | Papercut | 21.0.0 (including) | 21.2.14 (excluding) |
| Papercut_mf | Papercut | 22.0.0 (including) | 22.1.5 (excluding) |
| Papercut_mf | Papercut | 23.0.1 (including) | 23.0.7 (excluding) |
| Papercut_ng | Papercut | * | 20.1.10 (excluding) |
| Papercut_ng | Papercut | 21.0.0 (including) | 21.2.14 (excluding) |
| Papercut_ng | Papercut | 22.0.0 (including) | 22.1.5 (excluding) |
| Papercut_ng | Papercut | 23.0.1 (including) | 23.0.7 (excluding) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/104.html
- https://cwe.mitre.org/data/definitions/470.html
- https://cwe.mitre.org/data/definitions/69.html