Vulnerability · Published Sep 20, 2023 · Assigned by Fluid Attacks
CVE-2023-2508CSRF in PaperCutNG Mobility Print leads to sophisticated phishing
Medium 5.3
In plain English
A medium-severity cross-site request forgery in Mobility Print from PaperCut MF/NG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients host (in the "configure printer discovery" section). This is possible because the application has no protections against CSRF attacks, like Anti-CSRF tokens, header origin validation, samesite cookies, etc.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PaperCut MF/NG | Mobility Print | 1.0.3512 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N