HIGH

CVE-2023-27351

Papercut Papercut Mf 2023-04-20 CVSS v3.1

CVSS

7.5

KEV

Description

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

Summary dbcve.org

This is an authentication bypass vulnerability in PaperCut NG 22.0.5 where the SecurityRequestFilter class has an improper implementation of its authentication algorithm. Remote attackers can exploit this to bypass authentication entirely without needing any valid credentials.

Mitigation

Apply the vendor patch or upgrade to a patched version of PaperCut NG. Verify that the SecurityRequestFilter now correctly enforces authentication on all protected endpoints.

Weakness (CWE)

CWE-287 Improper Authentication

EPSS Score

78.05%

Probability of exploitation in next 30 days

99.6th percentile

References

https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 Vendor Advisory https://www.zerodayinitiative.com/advisories/ZDI-23-232/ Third Party Advisory, VDB Entry https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE