Back to KEVs

CVE-2023-2533

PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

Basic Information

CVE State
PUBLISHED
Reserved Date
May 05, 2023
Published Date
June 20, 2023
Last Updated
July 28, 2025
Vendor
PaperCut
Product
PaperCut NG/MF
Description
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
Tags
cisa

CVSS Scores

CVSS v3.1

8.4 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS Score

Score
0.08% (Percentile: 25.41%) as of 2025-07-28

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2025-07-26 04:40:25 UTC) Source

References

https://fluidattacks.com/advisories/arcangel/ https://www.papercut.com/kb/Main/SecurityBulletinJune2023

Known Exploited Vulnerability Information

Source Added Date
CVE 2025-07-26 04:40:18 UTC

Recent Mentions

CISA Adds PaperCut NG/MF CSRF Vulnerability to KEV Catalog Amid Active Exploitation

Source: TheHackerNews • Published: 2025-07-29 04:51:00 UTC

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security vulnerability impacting PaperCutNG/MF print management software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2023-2533 (CVSS score: 8.4), is a cross-site request forgery (CSRF) bug that could

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel