PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability.
The specific flaw exists within the External User Lookup functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute Java code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21013.
References
| Link | Resource |
|---|---|
| https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/ | Related Vendor Advisory |
| https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/ | Related Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1285/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1285/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Jan 2025, 14:53
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-94 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-23-1285/ - Third Party Advisory | |
| References | () https://www.papercut.com/kb/Main/SecurityBulletinJuly2023/ - Related, Vendor Advisory | |
| CPE | cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:* cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:* |
|
| First Time |
Papercut papercut Ng
Papercut Papercut papercut Mf |
03 May 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-03 03:15
Updated : 2025-01-30 14:53
NVD link : CVE-2023-39469
Mitre link : CVE-2023-39469
JSON object : View
Products Affected
papercut
- papercut_mf
- papercut_ng
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')