github - ghsa-9q29-w6f4-hc36

GHSA-9Q29-W6F4-HC36

Vulnerability from github – Published: 2023-09-20 18:30 – Updated: 2024-04-04 07:46

Details

The PaperCutNG Mobility Print version 1.0.3512 application allows an

unauthenticated attacker to perform a CSRF attack on an instance

administrator to configure the clients host (in the "configure printer

discovery" section). This is possible because the application has no

protections against CSRF attacks, like Anti-CSRF tokens, header origin

validation, samesite cookies, etc.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-2508"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-20T16:15:12Z",
    "severity": "MODERATE"
  },
  "details": "The `PaperCutNG Mobility Print` version 1.0.3512 application allows an\n\nunauthenticated attacker to perform a CSRF attack on an instance\n\nadministrator to configure the clients host (in the \"configure printer\n\ndiscovery\" section). This is possible because the application has no\n\nprotections against CSRF attacks, like Anti-CSRF tokens, header origin\n\nvalidation, samesite cookies, etc.\n\n\n\n",
  "id": "GHSA-9q29-w6f4-hc36",
  "modified": "2024-04-04T07:46:20Z",
  "published": "2023-09-20T18:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2508"
    },
    {
      "type": "WEB",
      "url": "https://fluidattacks.com/advisories/solveig"
    },
    {
      "type": "WEB",
      "url": "https://www.papercut.com/help/manuals/mobility-print/release-history/#mobility-print-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-2508 (GCVE-0-2023-2508)

Vulnerability from cvelistv5 – Published: 2023-09-20 15:05 – Updated: 2024-09-24 15:20

Summary

The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients host (in the "configure printer discovery" section). This is possible because the application has no protections against CSRF attacks, like Anti-CSRF tokens, header origin validation, samesite cookies, etc.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

Fluid Attacks

References

URL

Tags

	https://fluidattacks.com/advisories/solveig/
	https://www.papercut.com/help/manuals/mobility-pr…

Impacted products

	Vendor	Product	Version
	PaperCut MF/NG	Mobility Print	Affected: 1.0.3512

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:26:08.899Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://fluidattacks.com/advisories/solveig/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.papercut.com/help/manuals/mobility-print/release-history/#mobility-print-server"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T15:20:15.915578Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T15:20:41.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mobility Print",
          "vendor": "PaperCut MF/NG",
          "versions": [
            {
              "status": "affected",
              "version": " 1.0.3512"
            }
          ]
        }
      ],
      "datePublic": "2023-09-20T15:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eThe `PaperCutNG Mobility Print` version 1.0.3512 application allows an\u003c/div\u003e\u003cdiv\u003eunauthenticated attacker to perform a CSRF attack on an instance\u003c/div\u003e\u003cdiv\u003eadministrator to configure the clients host (in the \"configure printer\u003c/div\u003e\u003cdiv\u003ediscovery\" section). This is possible because the application has no\u003c/div\u003e\u003cdiv\u003eprotections against CSRF attacks, like Anti-CSRF tokens, header origin\u003c/div\u003e\u003cdiv\u003evalidation, samesite cookies, etc.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "The `PaperCutNG Mobility Print` version 1.0.3512 application allows an\n\nunauthenticated attacker to perform a CSRF attack on an instance\n\nadministrator to configure the clients host (in the \"configure printer\n\ndiscovery\" section). This is possible because the application has no\n\nprotections against CSRF attacks, like Anti-CSRF tokens, header origin\n\nvalidation, samesite cookies, etc.\n\n\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-98",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-98 Phishing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-20T15:05:35.512Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "url": "https://fluidattacks.com/advisories/solveig/"
        },
        {
          "url": "https://www.papercut.com/help/manuals/mobility-print/release-history/#mobility-print-server"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CSRF in PaperCutNG Mobility Print leads to sophisticated phishing",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2023-2508",
    "datePublished": "2023-09-20T15:05:35.512Z",
    "dateReserved": "2023-05-03T22:24:15.839Z",
    "dateUpdated": "2024-09-24T15:20:41.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-9Q29-W6F4-HC36

CVE-2023-2508 (GCVE-0-2023-2508)

Tags

Sightings

Nomenclature