Facebook Twitter Instagram
    • Privacy Policy
    • Contact Us
    Facebook Twitter Instagram Pinterest Vimeo
    AI Home SecurityAI Home Security
    • Home
    • Home Security
    • Cyber Security
    • Biometric Technology
    Contact
    AI Home SecurityAI Home Security
    Cyber Security

    Researchers Uncover New High-Severity Vulnerability in PaperCut Software

    justmattgBy justmattgAugust 6, 2023No Comments2 Mins Read

    [ad_1]

    Aug 05, 2023THNVulnerability / Software Security

    Vulnerability in PaperCut Software

    Cybersecurity researchers have discovered a new high-severity security flaw in PaperCut print management software for Windows that could result in remote code execution under specific circumstances.

    Tracked as CVE-2023-39143 (CVSS score: 8.4), the flaw impacts PaperCut NG/MF prior to version 22.1.3. It has been described as a combination of a path traversal and file upload vulnerability.

    “CVE-2023-39143 enables unauthenticated attackers to potentially read, delete, and upload arbitrary files to the PaperCut MF/NG application server, resulting in remote code execution in certain configurations,” Horizon3.ai’s Naveen Sunkavally said.

    The cybersecurity firm said that file upload leading to remote code execution is possible when the external device integration setting is enabled, which is on by default in some installations of PaperCut.

    Cybersecurity

    Earlier this April, another remote code execution vulnerability in the same product (CVE-2023-27350, CVSS score: 9.8) and an information disclosure flaw (CVE-2023–27351) came under widespread exploitation in the wild to deliver Cobalt Strike and ransomware. Iranian nation-state actors were also spotted abusing the bugs to obtain initial access to target networks.

    PaperCut Software

    “Compared to CVE-2023-27350, CVE-2023-39143 also does not require attackers to have any prior privileges to exploit, and no user interaction is required,” Sunkavally noted. “CVE-2023-39143 is more complex to exploit, involving multiple issues that must be chained together to compromise a server. It is not a ‘one-shot’ RCE vulnerability.”

    Also remediated by PaperCut in version 22.1.3 is a security flaw that could allow an unauthenticated attacker with direct server IP access to upload arbitrary files into a target directory, leading to a potential denial-of-service (CVE-2023-3486, CVSS score: 7.4). Tenable has been credited with discovering and reporting the issue.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.



    [ad_2]

    Source link

    Previous ArticleHow to Talk So Your CISO Will Listen
    Next Article Google, Microsoft Take Refuge in Rust Language’s Better Security
    justmattg
    • Website

    Related Posts

    Cyber Security

    Name That Toon: Last Line of Defense

    April 16, 2024
    Cyber Security

    OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt

    April 16, 2024
    Cyber Security

    Middle East Cyber Ops Intensify, With Israel the Main Target

    April 16, 2024
    Add A Comment

    Leave A Reply Cancel Reply

    Facebook Twitter Instagram Pinterest
    • Privacy Policy
    • Contact Us
    AI Home Security © 2025 All rights reserved | Designed By ESmartsSolution

    Type above and press Enter to search. Press Esc to cancel.

    ↑