PaperCut NG SetupCompleted Authentication Bypass Vulnerability

Description

Authentication bypass in PaperCut NG 22.0.5 (Build 63914) due to improper authentication algorithm and access control, allowing remote attackers to bypass login and execute arbitrary code as SYSTEM.

Outbreak Alert

CVE-2023-27350 allows for an unauthenticated attacker to execute Remote Code Execution (RCE) on a PaperCut Application Server. Vulnerability exists within the SetupCompleted class and according to the vendor, this could be achieved remotely and without the need to log in.

View the full Outbreak Alert Report

Affected Applications

PaperCut NG

References