CVE-2023-39143
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
PaperCut NG and PaperCut MF before version 22.1.3 on Windows allow attackers to perform path traversal, enabling them to upload, read, or delete arbitrary files. This can lead to remote code execution when external device integration is enabled.
Risk Assessment
The risk to the organization includes the potential for remote code execution, which could result in data loss or system takeover.
Recommendation
It is recommended to upgrade to version 22.1.3 or later to mitigate this vulnerability and review the configuration of external device integration.
Original NVD description (English source)
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).