fluidattacks.com
https://fluidattacks.com/advisories/arcangel CVE-2023-2533
HIGHCISA KEV
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
Record summary
CVE-2023-2533 has a selected CVSS score of 8.4 (high). CISA lists CVE-2023-2533 in KEV.
Description
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Jul 28, 2025 · CISA
- VulnCheck KEV
- Listed · Jul 28, 2025 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationActive
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 26, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CISA | Version data not supplied | ||
PaperCut NG/MFBrowse PaperCut / PaperCut NG/MFDefault status: unaffected | CVE List | 22.0.10 to < 2.1.1 | affected |
| 21.2.12 | unaffected | ||
| 20.1.8 | unaffected | ||
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-2533 cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533 papercut.com
https://www.papercut.com/ papercut.com
https://www.papercut.com/kb/Main/SecurityBulletinJune2023