CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
Reported by fluid attacks · Published June 20, 2023
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PaperCut | PaperCut NG/MF | 22.0.10, 21.2.12, 20.1.8 |
| PaperCut | PaperCut NG/MF | 22.0.10, 21.2.12, 20.1.8 |
Timeline
- Jun 20, 2023 CVE Published
- Jun 21, 2023 EPSS Score (30 in total, the first dated here)
- Jul 26, 2025 PoC Published (27 in total, the first dated here)
- Jul 28, 2025 CISA KEV Added
- Jul 28, 2025 VulnCheck KEV Exploitation (5 in total, the first dated here)
- Jul 30, 2025 VulnCheck XDB Entry
- Oct 21, 2025 CVE Updated
- Apr 26, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-2533
vulnetix vdb fixes CVE-2023-2533Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-2533/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart