Vulnerability · Published Sep 13, 2023 · Assigned by tenable
CVE-2023-4568PaperCut NG Unauthenticated XMLRPC
Medium 6.5
In plain English
A medium-severity improper authentication in PaperCut NG from PaperCut. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)3.9%top 9.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC
Official description
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PaperCut | PaperCut NG | see references |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N