High severity · published Nov 22, 2024
CVE-2023-39470
PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability
7.2
CVSS
1.8%
EPSS
No
On KEV
Description
PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability.
The specific flaw exists within the management of the print.script.sandboxed setting. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20965.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
PaperCut MF/NG · PaperCut
before 22.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39470
Vendor Advisory
https://www.papercut.com/kb/Main/SecurityBulletinJune2023/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-786/
More from PaperCut MF/NG
9.8
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
9.8
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
9.1
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
8.8
CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
7.5
CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability