title: PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
description: A Cross-Site Request Forgery (CSRF) vulnerability has been identified in
PaperCut NG/MF, which, under specific conditions, could potentially enable
an attacker to alter security settings or execute arbitrary code. This could
be exploited if the target is an admin with a current login session. Exploiting
this would typically involve the possibility of deceiving an admin into clicking
a specially crafted malicious link, potentially leading to unauthorized changes.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
defaultStatus: unaffected
platforms: [Windows, Linux, MacOS]
product: PaperCut NG/MF
vendor: PaperCut
versions:
lessThan: 2.1.1, status: affected, version: 22.0.10, versionType: custom
status: unaffected, version: 21.2.12
status: unaffected, version: 20.1.8
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL