This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

The PaperCut MF running on the remote host is affected by an authentication bypass vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to bypass access control.

The PaperCut NG running on the remote host is affected by an authentication bypass vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to bypass access control.

ID	Name	Product	Family	Type	Severity
176401	PaperCut MF SecurityRequestFilter Authentication Bypass (CVE-2023-27351)	Nessus	CGI abuses	Remote	high
175674	PaperCut NG SecurityRequestFilter Authentication Bypass (CVE-2023-27351)	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2023-27351

high

Tenable Plugins

high

high