CVE-2023-2533: PaperCut NG/MF cross-site request forgery, now actively exploited
The short version: PaperCut NG/MF — widely used print-management software — has a cross-site request forgery (CSRF) flaw (CVE-2023-2533). If an attacker can lure a signed-in PaperCut administrator into clicking a crafted link, the attacker's request is carried out with that admin's authority, which can alter security settings and, under the right conditions, lead to code execution. It's now in CISA's KEV catalog with a remediation deadline. Steady hands — patch, and confirm your console isn't casually reachable.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice (see below) |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CVSS (Fluid Attacks, CNA) | 8.4 — High · AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H (PaperCut self-assessed 7.9) |
| EPSS | 29.25% · 98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation due 2025-08-18 (added 2025-07-28) |
| Known exploited? | Yes — added to KEV on evidence of active exploitation |
| Vulnerability type | CWE-352 cross-site request forgery → unauthorized configuration change / arbitrary code execution |
| Requires authenticated session? | The attacker is unauthenticated, but must trick a logged-in administrator into clicking a crafted link (UI:R) |
| Affected | PaperCut NG/MF before 20.1.8; 21.0.0–21.2.11; 22.0.0–22.1.0 |
| Fixed in | 20.1.8 · 21.2.12 · 22.1.1 |
What you need to know
CSRF works by abuse of trust, not by breaking a lock. The PaperCut admin console trusts requests that arrive with a valid session cookie. If an administrator is signed in and then visits an attacker-controlled page (or clicks a crafted link), the browser can be made to submit a state-changing request to PaperCut as that admin — without the attacker ever knowing the password.
That matters because of what a PaperCut admin can change. The console governs security settings, and PaperCut's own advisory notes the flaw could, under specific conditions, be leveraged toward executing arbitrary code. So a "just a CSRF" bug becomes a route to tampering with the application's security posture on a server that often sits deep in the print/document path.
- It requires an authenticated admin to be tricked — that's a real precondition, and the mitigating factor here.
- But it's KEV-listed, meaning the theoretical has become operational, and print servers are frequently forgotten, internet-adjacent, and rarely patched on time.
How serious we see it
Moderate — in practice.
The precondition (a logged-in admin taking the bait) keeps this off the "Critical" shelf we reserve for pre-authentication, no-interaction takeovers. But CISA doesn't list vulnerabilities on theory, and the payoff — changing security settings or reaching code execution on a management server — is serious. The reassuring, bounded part is that this affects specific PaperCut builds, the fixes are published, and you can confirm your version and exposure quickly.
Recommendations
Straight from PaperCut's security bulletin and CISA:
- Patch now. Upgrade to 20.1.8 / 21.2.12 / 22.1.1 or later on all platforms.
- Get the admin console off the open internet. Restrict management access to trusted networks or a VPN; a console attackers (and their phishing links) can't reach is far harder to abuse.
- Hunt for tampering. Review admin/audit logs for unexpected security-setting changes, new accounts, or config edits around the exposure window.
- Harden sessions. Keep admin sessions short, sign out when done, and separate day-to-day browsing from privileged console use.
- Confirm your exposure first. Verify whether you run PaperCut NG/MF, which version, and whether its admin interface is reachable from the internet.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing PaperCut login and admin interfaces, fingerprints the NG/MF version, and flags exposure tied to KEV-listed vulnerabilities like this one — pushed to the top of your results because it's actively exploited rather than lost in a scanner backlog. We detect and flag the exposed, affected console; we don't phish your administrators to prove the CSRF.
That continuous, attacker's-eye view is the point: the forgotten print server that never makes the patch list is exactly the asset this surfaces before someone else finds it.