Critical severity · published Apr 20, 2023
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 21, 2023
Federal remediation dueMay 12, 2023
Ransomware campaign useKnown
Affected products
Which versions
PM
PaperCut MF/NG · PaperCut
22.0.5 (Build 63914) · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27350
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.zerodayinitiative.com
https://www.zerodayinitiative.com/advisories/ZDI-23-233/
www.papercut.com
https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
packetstormsecurity.com
http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html
packetstormsecurity.com
http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html
news.sophos.com
https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/
packetstormsecurity.com
http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html
More from PaperCut MF/NG
9.8
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
9.1
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
8.8
CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
7.5
CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability
9.8
CVE-2024-1222
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges