Back to KEVs

CVE-2023-27350

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication...

Basic Information

CVE State: PUBLISHED
Reserved Date: February 28, 2023
Published Date: April 20, 2023
Last Updated: February 03, 2025
Vendor: PaperCut
Product: NG
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Tags

CVSS Scores

CVSS v3.0

9.8 - CRITICAL

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (2023-04-21 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2025-03-09 18:08:42 UTC) Source
Used in Malware: Yes (added 2023-04-21 00:00:00 UTC) Source

References

https://www.zerodayinitiative.com/advisories/ZDI-23-233/ https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/ http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html

Known Exploited Vulnerability Information

Source	Added Date
CISA	2023-04-21 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_auth_bypass.rb	2025-04-29 11:01:23 UTC
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27350.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

papercut_ng_auth_bypass

Type: metasploit • Created: Unknown

Metasploit module for CVE-2023-27350

monke443/CVE-2023-27350

Type: github • Created: 2025-03-09 18:08:42 UTC • Stars: 3

Unauthenticated remote command execution in Papercut service allows an attacker to execute commands due to improper access controls in the SetupCompleted Java class.