{"id":"CVE-2023-27351","kind":"vulnerability","aliases":["CVE-2023-27351"],"related":[],"title":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5…","description":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.","summary":"PaperCut NG and PaperCut MF print management servers contain an improper authentication flaw in the SecurityRequestFilter class. A remote attacker can bypass login on affected installs and reach administrative functions.","severity":"critical","cvss":8.2,"epss":null,"exploited":true,"exploited_at":"2026-04-20T00:00:00+00:00","products":[{"name":"PaperCut NG/MF","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"papercut mf","fixed":["20.1.7"],"affected":">= 15.0, < 20.1.7","ecosystem":"vendor"},{"name":"papercut mf","fixed":["21.2.11"],"affected":">= 21.0.0, < 21.2.11","ecosystem":"vendor"},{"name":"papercut mf","fixed":["22.0.9"],"affected":">= 22.0.0, < 22.0.9","ecosystem":"vendor"},{"name":"papercut ng","fixed":["20.1.7"],"affected":">= 15.0, < 20.1.7","ecosystem":"vendor"},{"name":"papercut ng","fixed":["21.2.11"],"affected":">= 21.0.0, < 21.2.11","ecosystem":"vendor"},{"name":"papercut ng","fixed":["22.0.9"],"affected":">= 22.0.0, < 22.0.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","papercut","print-server","ransomware","self-hosted","vendor"],"not_affected_if":["managed-hosting","unaffected-version"],"how_to_check":null,"fix":"Apply the mitigation or patched build from PaperCut's vendor advisory; the sources do not name the fixed version. Follow CISA BOD 22-01 guidance if the product is cloud-hosted, or stop using it if no mitigation exists.","status":"open","published_at":"2023-04-20T16:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:48+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:38:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or patched build from PaperCut's vendor advisory; the sources do not name the fixed version. Follow CISA BOD 22-01 guidance if the product is cloud-hosted, or stop using it if no mitigation exists.","reach":"internet","summary":"PaperCut NG and PaperCut MF print management servers contain an improper authentication flaw in the SecurityRequestFilter class. A remote attacker can bypass login on affected installs and reach administrative functions.","category":"vendor","who_cares":["papercut","self-hosted","print-server"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker bypasses authentication and takes over the print management server.","analyst_note":"Find the affected and fixed PaperCut NG/MF version ranges and the vendor mitigation steps in PaperCut's advisory, linked from the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","unaffected-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2545,"output_tokens":393,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':17A,20A '-27351':18A,21A '19226':135C '22.0.5':15A,90C '63914':92C 'administr':74B 'affect':10A,70B,85C 'algorithm':118C 'allow':3A,78C 'attack':5A,65B,80C,120C 'authent':8A,57B,83C,93C,117C,127C 'build':91C 'bypass':7A,67B,82C,126C 'class':62B,108C 'contain':54B 'cve':16A,19A 'exist':104C 'exploit':36B,98C 'flaw':58B,103C 'function':75B 'host':44B 'implement':114C 'improp':56B,113C 'instal':11A,71B,86C 'issu':110C 'leverag':122C 'login':68B 'manag':52B 'mf':25A,27A,29A,50B 'ng':14A,31A,33A,35A,47B,89C 'ng/mf':23A 'papercut':13A,22A,24A,26A,28A,30A,32A,34A,37B,46B,49B,88C 'print':39B,51B 'print-serv':38B 'ransomwar':41B 'reach':73B 'remot':4A,64B,79C 'requir':96C 'result':111C 'securityrequestfilt':61B,107C 'self':43B 'self-host':42B 'server':40B,53B 'specif':102C 'system':130C 'vendor':45B 'vulner':2A,77C,100C,124C 'within':105C 'zdi':133C 'zdi-can':132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-04-20T16:15:07+00:00","kev":{"dateAdded":"2026-04-20","dueDate":"2026-05-04","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-27351","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27351","severity":null,"published_at":"2026-04-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-27351","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27351","severity":null,"published_at":"2023-04-20T16:15:07+00:00","modified_at":"2026-10-01T19:17:14+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}