CVE-2023-27351
high CISA KEVPaperCut NG/MF Improper Authentication Vulnerability
Vendor / product: PaperCut — NG/MF
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 zdi-disclosures@trendmicro.com
- https://www.zerodayinitiative.com/advisories/ZDI-23-232/ zdi-disclosures@trendmicro.com
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 af854a3a-2127-422b-91ae-364da2661108
- https://www.zerodayinitiative.com/advisories/ZDI-23-232/ af854a3a-2127-422b-91ae-364da2661108
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351 134c704f-9b21-4f2e-91b3-4a467353bcc0