CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
Published Apr 20, 2023 · updated Jun 16, 2026 · papercut papercut mf
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2023 · Catalog
Detected
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in th
Apr 21, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 12, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in th
Required action
Apply updates per vendor instructions.
CISA due date May 12, 2023
Affected
- cpe papercut/papercut mfversion unspecified
- cpe papercut/papercut ngversion unspecified
- vendor PaperCut MF/NGversion unspecified
Sources
- CISA KEVCVE-2023-27350
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
cisa.gov - CVE.orgCVE-2023-27350
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-27350
30-day exploitation probability 100.0%
first.org - Exploit Database51391
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database51452
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/papercut_ng_auth_bypass
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improp
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html
Packet Storm link already published on the finding.
packetstormsecurity.com