CVE-2023-6006
CVE-2023-6006 is a high-severity vulnerability in Papercut Papercut Mf with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-250.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-250
- Affected product: Papercut Papercut Mf
- Published:
- Last modified:
Description
This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.
Frequently asked questions
- What is CVE-2023-6006?
- This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.
- How severe is CVE-2023-6006?
- CVE-2023-6006 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2023-6006 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-6006?
- CVE-2023-6006 primarily affects Papercut Papercut Mf. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-6006?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2023-6006 published?
- CVE-2023-6006 was published on 2023-11-14 and last updated on 2026-06-17.
References
- https://www.papercut.com/kb/Main/Security-Bulletin-November-2023/
- https://www.papercut.com/kb/Main/CommonSecurityQuestions/
Affected products (2)
- cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
- cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
More vulnerabilities in Papercut Papercut Mf
- CVE-2023-39143 — Critical (CVSS 9.8): PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or…
- CVE-2023-27350 — Critical (CVSS 9.8): This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5…
- CVE-2019-12135 — Critical (CVSS 9.8): An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions…
- CVE-2019-8948 — Critical (CVSS 9.8): PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
- CVE-2024-1222 — High (CVSS 8.6): This allows attackers to use a maliciously formed API request to gain access to an API authorization level with…
- CVE-2023-2533 — High (CVSS 8.4): A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific…
All CVEs affecting Papercut Papercut Mf →
Other CWE-250 vulnerabilities
- CVE-2026-4606 — Critical (CVSS 10.0): GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing…
- CVE-2022-2634 — Critical (CVSS 10.0): An attacker may be able to execute malicious actions due to the lack of device access protections and device…
- CVE-2026-48584 — Critical (CVSS 9.9): Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a…
- CVE-2026-50566 — Critical (CVSS 9.9): Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and…
- CVE-2026-44477 — Critical (CVSS 9.9): CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and…
- CVE-2026-25212 — Critical (CVSS 9.9): An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser…