Context over chaos. Disconnected technologies, siloed data, and reactive processes can only get you so far. Protecting businesses in today’s threat landscape demands more than a set of security tools – it requires context.
That's where Avertium comes in
Security. It’s in our DNA. It’s elemental, foundational. Something that an always-on, everything’s-IoT-connected world depends on.
Helping mid-to-enterprise organizations protect assets and manage risk is our only business. Our mission is to make our customers’ world a safer place so that they may thrive in an always-on, connected world.
Best-in-class technology from our partners... backed by service excellence from Avertium.
Interested in becoming a partner?
With Avertium's deal registration, partners can efficiently and confidently connect with Avertium on opportunities to protect your deals.
Microsoft Copilot for Security analyzes and synthesizes high volumes of security data which can help healthcare cybersecurity teams do more with less.
Dive into our resource hub and explore top
cybersecurity topics along with what we do
and what we can do for you.
overview
Two vulnerabilities tracked as CVE-2023-27350 and CVE-2023-27351 have been found in PaperCut, a print management software solution used by over 100 million users from 70,000 organizations. The most recent attacks on PaperCut servers are coming from the Clop and LockBit ransomware operations.
CVE-2023-27350, which has a critical CVSS score of 9.8, affects all versions of PaperCut MF or NG 8.0 or later. The vulnerability impacts both application and site servers across all operating system platforms. PaperCut’s advisory states that under certain circumstances the vulnerability allows for unauthenticated attackers to obtain Remote Code Execution (RCE) on a PaperCut ApplicationServer, without the need to log in.
The second vulnerability, CVE-2023-27351, has a high CVSS score of 8.2 and permits unauthenticated information disclosure on PaperCut MF or NG 15.0 or later, specifically on application servers, across all OS platforms. PaperCut’s advisory states that under certain circumstances an unauthenticated attacker could pull information about a user including usernames, email addresses, and full names. The attacker could also obtain hashed passwords for internal PaperCut-created users.
Earlier in the month, PaperCut confirmed that the vulnerabilities were being actively exploited. A few days after disclosure, a PoC for CVE-2023-27530 was released, which allowed attackers to breach servers using the exploits. Papercut has issued patches to address the vulnerabilities and recommends that all admins upgrade their servers to the latest version.
INDICATORS OF COMPROMISE (IoCs)
FileHash-MD5
FileHash-SHA1
FileHash-SHA256
Domain
Hostname
SUPPORTING DOCUMENTATION
URGENT | PaperCut MF/NG vulnerability bulletin (March 2023) | PaperCut
Update Now PaperCut Vulnerability CVE-2023-27350 Under Active Exploitation (trendmicro.com)
PaperCut CVE-2023-27350 Deep Dive and Indicators of Compromise – Horizon3.ai
Microsoft: Clop and LockBit ransomware behind PaperCut server hacks (bleepingcomputer.com)