Lucene search

K
zdiAmol Dosanjh of Trend Micro and Michael DePlante (@izobashi) of Trend Micro's Zero Day InitiativeZDI-23-1798
HistoryDec 15, 2023 - 12:00 a.m.

PaperCut NG Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

2023-12-1500:00:00
Amol Dosanjh of Trend Micro and Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
www.zerodayinitiative.com
2
papercut ng
local
privilege escalation
vulnerability
uncontrolled search path element

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.4%

This vulnerability allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.4%

Related for ZDI-23-1798