CVE-2024-1884

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
PaperCut	PaperCut NG, PaperCut MF	< 23.0.7; < 22.1.5; < 21.2.14; < 20.1.10
papercut	papercut_ng	< 23.0.7; < 22.1.5; < 21.2.14; < 20.1.10
papercut	papercut_mf	< 23.0.7; < 22.1.5; < 21.2.14; < 20.1.10

References

https://www.papercut.com/kb/Main/Security-Bulletin-March-2024Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024Vendor Advisory

Timeline

Published: Mar 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-18859.8This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.CVE-2024-18868.8This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.CVE-2024-18874.3Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the CVE-2024-18884.3Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to CVE-2024-18898.8Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker CVE-2024-18905.4Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a CVE-2024-18915.4A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code CVE-2024-18926.5A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in CVE-2024-18938.8The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in a CVE-2024-18945.4The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b CVE-2024-18957.5The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all vers CVE-2024-18967.5The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulner