{"id":"CVE-2023-27351","published":"2023-04-20T16:15:07Z","modified":"2026-10-01T19:17:14Z","title":"PaperCut NG/MF Improper Authentication Vulnerability","vendor":"PaperCut","product":"NG/MF","tier":"core","eol":null,"description":{"text":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.","provenance":"source","from":"NVD"},"summary":{"text":"PaperCut NG/MF contains an improper authentication flaw in the SecurityRequestFilter class, which affects PaperCut NG 22.0.5 (Build 63914). A remote attacker can bypass authentication on the system because the authentication algorithm is improperly implemented, and no authentication or user interaction is needed to exploit it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:07Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.78052,"percentile":0.99574,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-04-20","dueDate":"2026-05-04","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 ; https://nvd.nist.gov/vuln/detail/CVE-2023-27351","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-28","exploitedFirstSeen":"2023-04-28","ransomware":true,"evidence":[{"url":"https://www.hhs.gov/sites/default/files/cl0p-lockbit-new-data-breaches-sector-alert.pdf","date":"2023-04-28"},{"url":"https://www.hhs.gov/sites/default/files/threat-profile-june-2023.pdf","date":"2023-06-13"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%202023%20Year%20in%20Review.pdf","date":"2024-01-24"},{"url":"https://www.sentinelone.com/resources/watchtower-end-of-year-report-2023/","date":"2024-01-31"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://thehackernews.com/2024/04/cl0ps-ransomware-rampage-security.html","date":"2024-04-09"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/05/08/inside-lockbit-defense-lessons-from-the-leaked-lockbit-negotiations","date":"2025-05-08"},{"url":"https://www.honeywell.com/content/dam/honeywellbt/en/documents/gated/hon-corp-honeywell-2025-cyber-threat-report.pdf","date":"2025-06-04"},{"url":"https://www.akamai.com/resources/state-of-the-internet/ransomware-trends-2025","date":"2025-09-18"}],"evidenceTotal":109,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-232/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-232/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27351","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated exploit of public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to bypass authentication","start":19,"end":67}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: authentication bypass yields valid-looking access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Authentication is not required to exploit this vulnerability","start":131,"end":191}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-31127","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31127","exploited":true,"exploitedSince":"2026-04-20","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2023-27351","name":"PaperCut NG - Authentication Bypass","severity":"high","path":"http/cves/2023/CVE-2023-27351.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27351.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2023-04-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27351","provenance":"source"},{"date":"2023-04-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.hhs.gov/sites/default/files/cl0p-lockbit-new-data-breaches-sector-alert.pdf","provenance":"source"},{"date":"2026-04-20","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31127","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1096},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1280 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9957"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}