Tim Kornhuber

PaperCut Print Deploy, an optional component integrated with PaperCut NG/MF, is susceptible to man-in-the-middle attacks if not correctly configured with a trusted certificate. Insufficient documentation regarding SSL configuration may lead to misconfiguration of the client installation, potentially exposing communication between clients and the server.

The issue allows an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.

The Platform component could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the same privilege level as the web access process.

A file access issue existed with certain home folder files, allowing a malicious application to potentially read sensitive location information. This issue was addressed with improved access restrictions.