Actively exploited in the wild
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
PaperCut - NG/MF · Listed in the CISA KEV since 2025-07-28. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2023-2533
HighCVSS 8.4KEVSummary
Zidentyfikowano podatność Cross-Site Request Forgery (CSRF) w PaperCut NG/MF, która w określonych warunkach może umożliwić atakującemu zmianę ustawień zabezpieczeń lub wykonanie dowolnego kodu. Wykorzystanie tej podatności jest możliwe, gdy celem jest administrator z aktywną sesją logowania.
Risk Assessment
Wykorzystanie tej podatności może prowadzić do nieautoryzowanych zmian w systemie, co stwarza poważne zagrożenie dla bezpieczeństwa organizacji. Atakujący może oszukać administratora, zmuszając go do kliknięcia w złośliwy link.
Recommendation
Zaleca się wdrożenie odpowiednich środków ochrony przed CSRF, takich jak weryfikacja tokenów oraz edukacja administratorów na temat potencjalnych zagrożeń związanych z klikaniem w nieznane linki.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.