VDB
CVE-2023-2533
CVE-2023-2533
PUBLISHED
KEV
CVSS 8.399999618530273 HIGH
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
EPSS 28.83% · 98.2th percentile
Risk Scores
CVSS 3.1
8.399999618530273
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS Score
28.83%
98.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| papercut | papercut_ng | 0, 22.0.0, 21.0.0 |
| PaperCut | PaperCut NG/MF | 22.0.10, 20.1.8, 21.2.12 |
| papercut | papercut_mf | 22.0.0, 0, 21.0.0 |
Timeline
- Jun 20, 2023 CVE Published
- Jun 21, 2023 EPSS Score
- Aug 31, 2023 EPSS Score
- Oct 5, 2023 EPSS Score
- Dec 15, 2023 EPSS Score
- Jan 20, 2024 EPSS Score
- Mar 31, 2024 EPSS Score
- May 5, 2024 EPSS Score
- Jul 15, 2024 EPSS Score
- Aug 19, 2024 EPSS Score
- Oct 29, 2024 EPSS Score
- Jan 9, 2025 EPSS Score
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 advisory
- https://www.papercut.com/kb/Main/SecurityBulletinJune2023 url
- https://fluidattacks.com/advisories/arcangel/ exploit
- https://nvd.nist.gov/vuln/detail/CVE-2023-2533 advisory
- https://fluidattacks.com/advisories/arcangel url
- https://www.papercut.com url