PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
PaperCut · NG/MF
PaperCut NG/MF contains a Cross-Site Request Forgery (CSRF) flaw that lets a crafted request be forged on behalf of a user. The flaw is exposed to remote attackers without authentication, but it requires user interaction: an administrator with an active login session must be tricked into clicking a malicious link, after which the attacker can change security settings or potentially execute arbitrary code.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 years after disclosure.
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 3Initial AccessTA0001
A CSRF vulnerability in PaperCut NG/MF can be exploited by an attacker targeting an admin with a current login session and tricking the admin into clicking a link. This exploit can lead to security setting modification and arbitrary code execution.
ExecutionTA0002
PersistenceTA0003
Detection
0 rules for this CVE · 106 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-2533 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Spearphishing LinkT1566.0024 general rules
- Potential Malicious Usage of CloudTrail System Managerhightest
- Suspicious Execution via macOS Script Editormediumtest
- Suspicious Email Delivered In Microsoft 365mediumexperimental
- EvilTokens PhaaS Kit Phishing Related Request - Proxylowexperimental
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Boot or Logon Autostart ExecutionT15477 general rules
- Potential RipZip Attack on Startup Folderhightest
- Registry Persistence Mechanisms in Recycle Binhightest
- Suspicious GrpConv Executionhightest
- WINEKEY Registry Modificationhightest
- Atbroker Registry Changemediumtest
- Startup/Logon Script Added to Group Policy Objectmediumtest
- Suspicious Driver Install by pnputil.exemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX