CVSS—
Severityhigh
Weakness—
EPSS100.0%100.0th percentile
Exploited3 KEV sources
Ransomware useKnown
Federal fix dueMay 12, 2023
patch window
Called exploited 2 days before disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing2d
- Last KEV listing3d
- Last sighting3.4y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Apr 21, 2023
- EUVDENISA, European Unionlisted Apr 21, 2023
- VulnCheck KEVcommercial researchlisted Apr 18, 2023
- CIRCLaggregator, mirrors the abovelisted Apr 21, 2023, not counted
Sources3 of 3
Listings differ by3 d
Strongest claimconfirmed
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationgithub.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-pa
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2023-2
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationwww.f5.com/labs/articles/weekly-threat-bulletin-september-2n
822 public reports collected from VulnCheck and CIRCL, first on Apr 18, 2023. Each links to its original source. We have not verified them.
Description
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
Required action (CISA)
Apply updates per vendor instructions.
