Security News > 2023 > August > Researchers Uncover New High-Severity Vulnerability in PaperCut Software

Cybersecurity researchers have discovered a new high-severity security flaw in PaperCut print management software for Windows that could result in remote code execution under specific circumstances.

Tracked as CVE-2023-39143, the flaw impacts PaperCut NG/MF prior to version 22.1.3.

"CVE-2023-39143 enables unauthenticated attackers to potentially read, delete, and upload arbitrary files to the PaperCut MF/NG application server, resulting in remote code execution in certain configurations," Horizon3.

The cybersecurity firm said that file upload leading to remote code execution is possible when the external device integration setting is enabled, which is on by default in some installations of PaperCut.

Earlier this April, another remote code execution vulnerability in the same product and an information disclosure flaw came under widespread exploitation in the wild to deliver Cobalt Strike and ransomware.

Also remediated by PaperCut in version 22.1.3 is a security flaw that could allow an unauthenticated attacker with direct server IP access to upload arbitrary files into a target directory, leading to a potential denial-of-service.

News URL

https://thehackernews.com/2023/08/researchers-uncover-new-high-severity.html