CVE-2023-2508 Vulnerability Details

  /     /     /  

CVE-2023-2508 Metadata Quick Info

CVE Published: 20/09/2023 | CVE Updated: 24/09/2024 | CVE Year: 2023
Source: Fluid Attacks | Vendor: PaperCut MF/NG | Product: Mobility Print
Status : PUBLISHED

---

CVE-2023-2508 Description

The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients host (in the "configure printer discovery" section). This is possible because the application has no protections against CSRF attacks, like Anti-CSRF tokens, header origin validation, samesite cookies, etc.

Metrics

CVSS Version: 3.1 | Base Score: 5.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* HIGH
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-352
CWE Name: CWE-352 Cross-Site Request Forgery (CSRF)
Source: PaperCut MF/NG

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-98
CAPEC Description: CAPEC-98 Phishing


Source: NVD (National Vulnerability Database).