CVE-2023-2533: high-severity vulnerability in PaperCut NG/MF
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
PaperCut MF/NG has a security flaw that allows an attacker to trick a logged-in administrator into making dangerous changes or running malicious code by clicking a specially crafted link. This happens because the application doesn't properly verify that requests come from legitimate users.
A CSRF vulnerability in PaperCut NG/MF 22.0.10 allows an unauthenticated attacker to forge requests that execute with an authenticated admin's privileges if the admin is tricked into clicking a malicious link. The attack vector is client-side social engineering; requires an active admin session and victim interaction. Impact includes arbitrary code execution and security configuration changes.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.