Vulnerability Intelligence Report
PaperCut NG/MF Improper Authentication Vulnerability
CVE-2023-27351
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
8.2
HIGH
Exploitability:3.9
Impact Score:4.3
EPSS Probability:78.42%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-287 ↗CWE-287: Improper Authentication
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PaperCut | NG | 22.0.5 (Build 63914) (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
78.420%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Zero Day Initiative · Bug Bounty Provider · Japan |
| Reserved | 2023-02-28T00:00:00 |
| Published | 2023-04-20T00:00:00 |
| Last Updated | 2026-04-21T03:55:37 |
Community Chatter & Buzz