CVE-2024-8404
Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server via the web-print-hot-folder. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Note: This CVE has been split from CVE-2024-3037.
Reserved 2024-09-04 | Published 2024-09-26 | Updated 2024-09-26 | Assigner PaperCutAmol Dosanjh of Trend Micro
Nicholas Zubrisky (@NZubrisky) of Trend Micro
Michael DePlante (@izobashi) of Trend Micro's ZDI
www.papercut.com/kb/Main/Security-Bulletin-May-2024/
Support options
