Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 1.0000 100.0 YES
AFFECTED Product Versions Fixed NG 22.0.5 (Build 63914) – —
TIMELINE Feb 28 Reserved by zdi Apr 20 Published (CNA: zdi) Apr 21 Added to CISA KEV, remediation due 2023-05-12
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
| Date | Event | Detail |
|---|---|---|
| February 28, 2023 | Reserved | Reserved by zdi |
| April 20, 2023 | Published | Published (CNA: zdi) |
| April 21, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-05-12 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| PaperCut | NG | — | 22.0.5 (Build 63914) | — |
Authoritative record: CVE-2023-27350 at cve.org
Vendors: papercut
Weaknesses: CWE-284
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-27350 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
