Arbitrary File Deletion in PaperCut NG/MF Web Print

CVE-2024-3037

Summary

An arbitrary file deletion vulnerability exists in PaperCut NG/MF impacting Windows servers with Web Print enabled. Exploitation requires the attacker to secure local login access to the vulnerable server and execute low-privilege code. This vulnerability might be mitigated in standard configurations where only Administrators are permitted local login. However, environments allowing non-administrative users local access face potential risks. The CVE has been differentiated into two distinct identifiers, reflecting an environment where local login permissions could lead to inadvertent exposure.

References