CVE-2023-2533
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
Description
CVE-2023-2533 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in PaperCut NG/MF, the widely deployed print management solution. The flaw allows an attacker to deceive an authenticated administrator into clicking a malicious link, which can alter security settings or execute arbitrary code on the PaperCut server. With a CVSS v3.1 score of 8.4 and the ability to affect resources beyond the vulnerable component (Changed scope), this vulnerability poses significant risk to organizations relying on PaperCut for print infrastructure management. CISA has added CVE-2023-2533 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 18, 2025, and the EPSS score of 36.32% at the 97th percentile confirms very high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| papercut | papercut mf | < 20.1.8; >= 21.0.0, < 21.2.12; >= 22.0.0, < 22.1.1 |
| papercut | papercut ng | < 20.1.8; >= 21.0.0, < 21.2.12; >= 22.0.0, <= 22.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://fluidattacks.com/advisories/arcangel/(Exploit, Third Party Advisory)
- https://www.papercut.com/kb/Main/SecurityBulletinJune2023(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2533(US Government Resource)
Weakness Type
CWE-352: Cross-Site Request Forgery (CSRF)
CVE-2023-2533 is classified under CWE-352 (Cross-Site Request Forgery), a vulnerability where a web application fails to verify that requests originate from the authenticated user rather than a third-party attacker. In PaperCut NG/MF, the administrative interface does not implement sufficient CSRF protections, allowing an attacker to craft malicious requests that execute administrative actions when triggered by an authenticated admin's browser session.
Learn more: CWE-352 — Cross-Site Request Forgery (CSRF)
Impact Analysis
CVE-2023-2533 carries severe implications due to PaperCut's role in managing print infrastructure across organizations. The vulnerability is network-exploitable (AV:N) with low complexity (AC:L), but requires high privileges on the target (PR:H) and user interaction (UI:R) in the form of an administrator clicking a malicious link. Critically, the scope is changed (S:C), meaning exploitation can affect resources beyond the PaperCut application itself. Confidentiality (High): forged requests can extract sensitive configuration data, user information, print job metadata, and authentication credentials from the PaperCut server. Integrity (High): the attacker can modify security settings, create new administrator accounts, alter print policies, and potentially execute arbitrary code on the server through administrative functionality. Availability (High): the attacker can disable the print management service, modify configurations to disrupt printing across the organization, or leverage code execution to compromise the underlying server. The EPSS score of 36.32% at the 97th percentile reflects active targeting, consistent with PaperCut's established position as a high-value target following previous exploitation campaigns.
Exploit Maturity
CVE-2023-2533 has a mature exploit landscape. Public exploit code is available through Fluid Attacks advisory which provides detailed technical information about the CSRF vulnerability. CISA has confirmed active exploitation through KEV catalog inclusion. The EPSS score of 36.32% at the 97th percentile indicates this vulnerability is among the top 3% most likely to be exploited. PaperCut products have been a prominent target since the widespread exploitation of CVE-2023-27350 (PaperCut NG/MF authentication bypass) by ransomware groups including Cl0p and LockBit. This CSRF vulnerability provides another attack path into PaperCut environments, and the vendor security bulletin confirms the issue and provides remediation guidance.
Remediation
-
Upgrade PaperCut NG/MF to a patched version: version 20.1.8 or later for the 20.x branch, version 21.2.12 or later for the 21.x branch, or version 22.1.1 or later for the 22.x branch. The PaperCut Security Bulletin June 2023 provides specific upgrade guidance.
-
Implement browser-based CSRF protections as a defense-in-depth measure. Ensure administrators use browsers with SameSite cookie enforcement and avoid clicking links from untrusted sources while authenticated to the PaperCut admin console.
-
Restrict access to the PaperCut admin interface by implementing IP-based access controls that limit administrative access to trusted management networks. Use a dedicated management workstation for PaperCut administration.
-
Enable multi-factor authentication for PaperCut admin sessions and configure session timeouts to minimize the window during which CSRF attacks can succeed. Require re-authentication for critical administrative actions.
-
Monitor PaperCut server logs for suspicious administrative actions including unexpected security setting changes, new administrator account creation, or code execution through administrative functions. Implement alerting for configuration changes that occur outside normal maintenance windows.
Technical Details
CVE-2023-2533 is a Cross-Site Request Forgery vulnerability in PaperCut NG/MF's administrative web interface. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H indicates a network-based attack with low complexity that requires high privileges (an active admin session) and user interaction (clicking a malicious link), with changed scope meaning the impact extends beyond the PaperCut application. The vulnerability exists because the PaperCut administrative interface does not implement anti-CSRF tokens or other verification mechanisms to ensure that state-changing requests originate from the legitimate admin user rather than a forged cross-site request. An attacker crafts a malicious webpage or link that, when visited by an authenticated PaperCut administrator, causes the administrator's browser to send forged requests to the PaperCut server. These requests carry the administrator's session cookies and are processed as legitimate administrative actions. The attack can target any administrative functionality including security settings modification and code execution capabilities. PaperCut NG versions before 20.1.8, 21.0.0 to 21.2.11, and 22.0.0 to 22.1.1 are affected, along with the corresponding PaperCut MF versions.
Frequently Asked Questions
Is CVE-2023-2533 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2023-2533 to the KEV catalog. Public exploit details are available through the Fluid Attacks advisory. The EPSS score of 36.32% at the 97th percentile confirms very high exploitation activity targeting PaperCut installations.
What products are affected by CVE-2023-2533?
PaperCut NG versions before 20.1.8, versions 21.0.0 through 21.2.11, and versions 22.0.0 through 22.1.1 are vulnerable. PaperCut MF has the same affected version ranges.
How do I fix CVE-2023-2533?
Upgrade PaperCut NG/MF to version 20.1.8, 21.2.12, or 22.1.1 or later depending on your branch. Additionally, restrict admin interface access to trusted networks and implement multi-factor authentication for administrative sessions.
How severe is CVE-2023-2533?
CVE-2023-2533 has a CVSS v3.1 score of 8.4 (High severity) with changed scope, meaning exploitation can affect systems beyond PaperCut itself. The 97th percentile EPSS score and confirmed active exploitation make this a high-priority patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.