CVE-2023-2508CWE-352

CSRF in PaperCutNG Mobility Print leads to sophisticated phishing

Medium · published September 20, 2023

CVSS v3.1
5.3
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

The `PaperCutNG Mobility Print` version 1.0.3512 application allows an

unauthenticated attacker to perform a CSRF attack on an instance

administrator to configure the clients host (in the "configure printer

discovery" section). This is possible because the application has no

protections against CSRF attacks, like Anti-CSRF tokens, header origin

validation, samesite cookies, etc.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2023-09-20T15:05Z
EPSS history
Timeline
  • 20 SEP 15:05Z
    CSRF in PaperCutNG Mobility Print leads to sophisticated phishing
    cvelistv5