CVE-2023-2533
HIGH KEVPaperCut NG/MF < 20.1.8 - Cross-Site Request Forgery
Title source: llmExploitation Summary
CVE-2023-2533 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 28, 2025.
Description
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
References (3)
Core 3
Core References
Exploit, Third Party Advisory
https://fluidattacks.com/advisories/arcangel/
Vendor Advisory
https://www.papercut.com/kb/Main/SecurityBulletinJune2023
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533
Scores
CVSS v3
8.4
EPSS
0.3632
EPSS Percentile
97.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
no
Technical Impact
total
Details
CISA KEV
2025-07-28
VulnCheck KEV
2025-07-28
ENISA EUVD
EUVD-2023-34012
CWE
CWE-352
Status
published
Products (2)
papercut/papercut_mf
< 20.1.8
papercut/papercut_ng
< 20.1.8
Published
Jun 20, 2023
KEV Added
Jul 28, 2025
Tracked Since
Feb 18, 2026