Medium severity · published Sep 13, 2023
CVE-2023-4568
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default
6.5
CVSS
3.9%
EPSS
No
On KEV
Description
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
PaperCut MF/NG · PaperCut
through 22.0.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4568
Exploit
https://www.tenable.com/security/research/tra-2023-31
More from PaperCut MF/NG
9.8
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
9.8
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
9.1
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
8.8
CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
7.5
CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability