CVSS: 9.8EPSS: 97%CPEs: 6EXPL: 14CVE-2023-27350 – PaperCut MF/NG Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. • https://github.com/horizon3ai/CVE-2023-27350 https://www.exploit-db.com/exploits/51391 https://www.exploit-db.com/exploits/51452 https://github.com/adhikara13/CVE-2023-27350 https://github.com/imancybersecurity/CVE-2023-27350-POC https://github.com/ThatNotEasy/CVE-2023-27350 https://github.com/Jenderal92/CVE-2023-27350 https://github.com/MaanVader/CVE-2023-27350-POC https://github.com/ASG-CASTLE/CVE-2023-27350 https://github.com/rasan2001/CVE-2023-27350-Ongoing-Exploitation-o • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 3%CPEs: 6EXPL: 0CVE-2023-27351 – PaperCut NG SecurityRequestFilter Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-27351
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. • https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 https://www.zerodayinitiative.com/advisories/ZDI-23-232 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 0CVE-2019-12135
https://notcve.org/view.php?id=CVE-2019-12135
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector. Una vulnerabilidad sin especificar en la aplicación server in PaperCut MF y NG versiones 18.3.8 y versiones anteriores 19.0.3 y anteriores, permiten que un atacante remoto ejecute códigos arbitrarios mediante un vector sin especificar. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history •