CVE-2023-4568

PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

3.57% chance of exploitation in the next 30 days, 89th percentile

Nuclei

medium · CWE-287

Published

2023-09-13

Updated

2024-09-25

Proof-of-concept exploits (2)

• https://www.tenable.com/security/research/tra-2023-31
• Cappricio-Securities/CVE-2023-45680★ · 2024-06-24

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4568.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297
• CVE-2017-7269