CVE-2023-39470: 
PaperCut NG vulnerability analysis and mitigation

CVE-2023-39470 is a remote code execution vulnerability in PaperCut NG that affects the print.script.sandboxed setting. The vulnerability was discovered in April 2023 and allows remote authenticated attackers to execute arbitrary code with SYSTEM privileges (ZDI Advisory).

The vulnerability exists within the management of the print.script.sandboxed setting in PaperCut NG. The specific flaw results from the exposure of a dangerous function that can be leveraged by authenticated attackers. The vulnerability has been assigned a CVSS score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network attack vector, low attack complexity, and requiring high privileges (ZDI Advisory).

Successful exploitation of this vulnerability allows authenticated remote attackers to execute arbitrary code in the context of SYSTEM privileges on affected PaperCut NG installations (ZDI Advisory).

PaperCut has released an update to address this vulnerability. Users should apply the security patch as detailed in the June 2023 Security Bulletin (PaperCut Security Bulletin).