CVE-2023-2533

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2533
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://fluidattacks.com/advisories/arcangel/ Exploit Third Party Advisory
https://www.papercut.com/kb/Main/SecurityBulletinJune2023 Vendor Advisory
https://fluidattacks.com/advisories/arcangel/ Exploit Third Party Advisory
https://www.papercut.com/kb/Main/SecurityBulletinJune2023 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
History

24 Oct 2025, 13:55

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 - US Government Resource

21 Oct 2025, 23:15

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 -

21 Oct 2025, 20:19

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:20

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 -
Summary
  • (es) Se ha identificado una vulnerabilidad de Cross-Site Request Forgery (CSRF) en PaperCut NG/MF que, en determinadas circunstancias, podría permitir a un atacante alterar la configuración de seguridad o ejecutar código arbitrario. Esto podría explotarse si el objetivo es un administrador con una sesión iniciada. Explotar esto normalmente implicaría la posibilidad de engañar a un administrador para que haga clic en un enlace malicioso especialmente manipulado, lo que podría provocar cambios no autorizados.

29 Jul 2025, 15:08

Type Values Removed Values Added
References () https://www.papercut.com/kb/Main/SecurityBulletinJune2023 - () https://www.papercut.com/kb/Main/SecurityBulletinJune2023 - Vendor Advisory
CPE cpe:2.3:a:papercut:papercut_mf:22.0.10:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_ng:22.0.10:*:*:*:*:*:*:*		 cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
Information

Published : 2023-06-20 15:15

Updated : 2025-10-24 13:55

NVD link : CVE-2023-2533

Mitre link : CVE-2023-2533

CVE.ORG link : CVE-2023-2533

JSON object : View

Products Affected

papercut

  • papercut_mf
  • papercut_ng
CWE
CWE-352

Cross-Site Request Forgery (CSRF)