Papercut Security (Heads Up)

[Michael]

Morning all,

 

For Papercut Admins, please read the following -

 

Security issue identified in PaperCut Application Server

 

Hi there,

 

We recently identified and resolved a security issue in our PaperCut Application Server. This email is to advise you of the nature of the issue, and to recommend next steps.

 

What’s the impact?

This security issue allows unauthorized users with access to the PaperCut Application Server web interface to potentially access a very limited set of user information without authentication. The user information at risk is limited to the user's full name, PaperCut username, and the primary and secondary Card/Identity Numbers that have been set for that user by their PaperCut administrator. The Card/ID PIN is not exposed by this issue.

 

If untrusted users can access the PaperCut Application Server web interface, or it’s publicly accessible to the internet, we highly recommend that you update to one of the available fixes listed below.

 

What are my next steps?

I normally get my software updated by my PaperCut reseller: If you have assessed that this issue requires action, we highly recommend you reach out to your PaperCut partner as you normally would when upgrading.

 

I normally update my PaperCut software myself: You can access the patched versions through the normal methods. If you are unsure please contact your PaperCut reseller to ensure your devices are on the correct firmware version. Also please confirm that your license covers your intended updated version.

 

I have PaperCut MF version 21.1

This security issue has been resolved in the latest version of PaperCut MF 21.1.1. If you’re currently using PaperCut MF 21.1.1, you’re already up-to-date with the latest security enhancements.

 

Please note, if your software version is 21.1.0, you will need to update to 21.1.1. The upgrade is accessible either through your PaperCut partner (recommended) or through dedicated links via the ‘Check for updates’ option in the ‘About’ page of the admin interface.

 

I have PaperCut MF version 21.0 or 20.x

We have maintenance releases available: PaperCut MF 21.0.5 and 20.1.4. These upgrades are accessible either through your PaperCut partner (recommended) or through dedicated links via the ‘Check for updates’ option in the ‘About’ page of the admin interface.

 

I have PaperCut MF version 19.x

We have a maintenance release available: PaperCut MF 19.2.5. This upgrade is accessible either through your PaperCut partner (recommended) or through dedicated links via the ‘Check for updates’ option in the ‘About’ page of the admin interface.

 

I have an earlier version of PaperCut MF

You'll need to upgrade to one of the versions above. We recommend reaching out to your PaperCut partner to ensure that the version you update to is compatible with the devices being managed. Please note that due to the Java update included in PaperCut MF 20.0, we highly recommend upgrading to at least version 20.0 to ensure you’re running those additional third-party security fixes.

 

Thank you for your attention on this issue. Please reach out to your PaperCut partner if you require any assistance beyond the scope of this email. You can find their details when you log in to your PaperCut Admin web interface, head to the ‘About’ page and find the ‘Sales and Solutions Contact’ and ‘Support’ sections.