Lucene search

K
zdiAmol Dosanjh of Trend Micro and Michael DePlante (@izobashi) of Trend Micro's Zero Day InitiativeZDI-23-1798
HistoryDec 15, 2023 - 12:00 a.m.

PaperCut NG Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

2023-12-1500:00:00
Amol Dosanjh of Trend Micro and Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
www.zerodayinitiative.com
3
papercut ng
local
privilege escalation
vulnerability
uncontrolled search path element

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

21.1%

This vulnerability allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

21.1%

Related for ZDI-23-1798