CVE-2023-27350
high-risk
Published 2023-04-20
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Do I need to act?
!
94.3% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (2)
Affected Vendors
References (15)
Third Party Advisory
http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass...
Third Party Advisory
https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-draw...
Vendor Advisory
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-233/
Third Party Advisory
http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass...
Third Party Advisory
https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-draw...
Vendor Advisory
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-233/
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-...
66
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
27/34 · High
Exposure
7/34 · Low