CVE-2023-27350
קריטית 9.8 מנוצלת בשטח (KEV) בשימוש בכופרה
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- PaperCut MF/NG Improper Access Control Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- Apply updates per vendor instructions.
תיאור (מקור, אנגלית)
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
מדדים
- CVSS 3.1
-
9.8 (CRITICAL)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 100% (אחוזון 100) נכון ל-25/7/2026
- CWE
- CWE-284
מוצרים מושפעים
papercut: papercut mf; papercut: papercut ng
קישורים
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 Vendor Advisory
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 Vendor Advisory
- http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authenticati… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authenticati… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypa… Third Party AdvisoryVDB Entry
- https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-dr… Third Party Advisory