CVE-2023-4568

PaperCut NG Unauthenticated XMLRPC

PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.

Affected

PaperCut · PaperCut NG

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

3.89% chance of exploitation in the next 30 days, 90th percentile

Nuclei

medium · CWE-287

Published

2023-09-13

Updated

2024-09-25

Proof-of-concept exploits (2)

• https://www.tenable.com/security/research/tra-2023-31
• Cappricio-Securities/CVE-2023-45680★ · 2024-06-24

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4568.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297
• CVE-2017-7269