Papercut
Products by Papercut Sorted by Most Security Vulnerabilities since 2018
Known Exploited Papercut Vulnerabilities
The following Papercut vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| PaperCut MF/NG Improper Access Control Vulnerability | PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. CVE-2023-27350 | April 21, 2023 |
By the Year
In 2024 there have been 0 vulnerabilities in Papercut . Last year Papercut had 6 security vulnerabilities published. Right now, Papercut is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 6 | 7.77 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 2 | 9.80 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Papercut vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Papercut Security Vulnerabilities
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1
CVE-2023-31046
6.5 - Medium
- October 19, 2023
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach getStaticContent in UIContentResource.class in the static-content-files servlet.
Directory traversal
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default
CVE-2023-4568
6.5 - Medium
- September 13, 2023
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
authentification
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior
CVE-2023-3486
7.5 - High
- July 25, 2023
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG hosts file storage. This could exhaust system resources and prevent the service from operating as expected.
Unrestricted File Upload
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in
PaperCut NG/MF
CVE-2023-2533
8.8 - High
- June 20, 2023
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
Session Riding
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914)
CVE-2023-27351
7.5 - High
- April 20, 2023
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
authentification
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914)
CVE-2023-27350
9.8 - Critical
- April 20, 2023
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Authorization
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier
CVE-2019-12135
9.8 - Critical
- June 06, 2019
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector.
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6
CVE-2019-8948
9.8 - Critical
- February 20, 2019
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
Injection