CVE-2023-27350

Published Apr 20, 2023

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-27350 is an unauthenticated remote code execution vulnerability affecting PaperCut MF and NG print management software. This flaw allows an attacker to bypass authentication and execute arbitrary code with SYSTEM privileges on vulnerable systems. The vulnerability is attributed to improper access controls within the `SetupCompleted` Java class. This issue impacts PaperCut MF or NG versions 8.0 and later, specifically including versions 8.0.0 to 19.2.7, 20.0.0 to 20.1.6, 21.0.0 to 21.2.10, and 22.0.0 to 22.0.8.

Description: This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Source: zdi-disclosures@trendmicro.com
NVD status: Analyzed
Products: papercut_mf, papercut_ng

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 3.0

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: PaperCut MF/NG Improper Access Control Vulnerability
Exploit added on: Apr 21, 2023
Exploit action due: May 12, 2023
Required action: Apply updates per vendor instructions.

Weaknesses

zdi-disclosures@trendmicro.com: CWE-284
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E225189C-FF05-402B-A8F6-6BCC8D062B8C",
            "versionEndExcluding": "20.1.7",
            "versionStartIncluding": "8.0"
          },
          {
            "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7D231C34-F58C-4CA1-B158-64778AC17991",
            "versionEndExcluding": "21.2.11",
            "versionStartIncluding": "21.0.0"
          },
          {
            "criteria": "cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A326E88D-635E-4AC1-B5CE-455306FC9D55",
            "versionEndExcluding": "22.0.9",
            "versionStartIncluding": "22.0.0"
          },
          {
            "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F5D942B-C055-4221-8FD7-3F0F252931E4",
            "versionEndExcluding": "20.1.7",
            "versionStartIncluding": "8.0"
          },
          {
            "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4DE19845-02F0-4BB9-BECB-49B34FACB55D",
            "versionEndExcluding": "21.2.11",
            "versionStartIncluding": "21.0.0"
          },
          {
            "criteria": "cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C1852E7B-0B3F-4208-A26E-CB117E0C0CD8",
            "versionEndExcluding": "22.0.9",
            "versionStartIncluding": "22.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.