CVE-2023-39143
CRITICAL EXPLOITED NUCLEIPaperCut NG/MF <22.1.3 - Path Traversal
Title source: llmExploitation Summary
CVE-2023-39143 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including foregenix. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional WebDAV crawler exploit for CVE-2023-39143, targeting PaperCut MF/NG. The script performs directory traversal and information leakage by crawling WebDAV paths to extract sensitive data, including user information.
Description
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).
Exploits (1)
The repository contains a functional WebDAV crawler exploit for CVE-2023-39143, targeting PaperCut MF/NG. The script performs directory traversal and information leakage by crawling WebDAV paths to extract sensitive data, including user information.
Nuclei Templates (1)
html:"content=\"PaperCut\"" || http.html:"papercut" || http.html:"content=\"papercut\"" || cpe:"cpe:2.3:a:papercut:papercut_mf"
body="papercut" || body="content=\"papercut\""
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H