CVE-2023-27351: PaperCut NG/MF Improper Authentication Vulnerability
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
Overview
PaperCut NG and MF contain an authentication bypass in the SecurityRequestFilter class that allows a remote, unauthenticated attacker to access protected resources without valid credentials. Affected versions span the 15.0 through 22.0.x release lines for both products. This vulnerability has been exploited in ransomware campaigns and is listed in the CISA Known Exploited Vulnerabilities catalog.
Vulnerability details
The SecurityRequestFilter class is responsible for enforcing authentication on incoming HTTP requests to the PaperCut print management server. CWE-287 (Improper Authentication) describes a failure at a trust boundary where the system accepts a request and incorrectly concludes the caller is authenticated. In this case, the authentication algorithm itself is implemented incorrectly, meaning a crafted request can pass through the filter without supplying valid credentials. The flaw is not a missing check that can be toggled by configuration but a logic error in the filter's decision path.
An attacker with network access to the PaperCut web interface sends a crafted HTTP request that the SecurityRequestFilter mishandles, granting access to protected functionality. No account, session token, or prior foothold is required. The primary confirmed consequence is unauthorized read access to sensitive print management data, though a secondary assessment also notes a low integrity impact, suggesting some actions beyond reading may be possible. Because the web interface is commonly exposed on internal networks and sometimes externally, the attack surface is broad, and the flaw's use in ransomware operations makes rapid remediation critical.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review PaperCut application server logs for requests to authenticated endpoints that lack a corresponding valid session or login event, particularly from source addresses with no prior authentication history against the server.
- Monitor for unexpected access to administrative or reporting functions in PaperCut audit logs where the associated user context is absent, anonymous, or does not match any known account in the directory.
Remediation
Additional hardening
- Upgrade PaperCut NG and PaperCut MF to version 20.1.7 or later (for the 15.0 line), 21.2.11 or later (for the 21.x line), or 22.0.9 or later (for the 22.0.x line); see the vendor advisory in References for full version guidance.
- Restrict network access to the PaperCut application server's web interface using firewall rules or network segmentation so that only authorized print clients, administrators, and management systems can reach it.
- If the PaperCut web interface does not need to be reachable from the internet, block external access at the perimeter and require VPN or jump-host access for remote administration.
- Audit PaperCut server logs for signs of unauthenticated access to protected endpoints prior to patching, given confirmed ransomware exploitation of this vulnerability.
Key dates
References
Frequently asked questions
Does CVE-2023-27351 affect my FedRAMP authorization?
If PaperCut NG/MF runs inside your authorization boundary, yes. CVE-2023-27351 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 4, 2026 has already passed. An unpatched KEV inside your boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2023-27351?
Knox does not patch your PaperCut NG/MF installation. Remediation is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that help you document the fix for your next assessment. The work of applying the patch is yours; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2023-27351. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at scheduled review time, giving your team the opportunity to act before a finding becomes a formal conversation.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2023-27351's remediation deadline of May 4, 2026 has passed. What happens now?
If CVE-2023-27351 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline slipped is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
