CVE-2023-39469 is a high severity (CVSS 7.2) code injection flaw in PaperCut NG, recorded as the External User Lookup issue. An authenticated administrator could run code as SYSTEM. PaperCut's bulletins map the CVE differently from NVD and give a lower score. Updating to 22.1.3 or later covers both readings.
What's affected
The NVD record lists PaperCut NG and PaperCut MF. It scores the flaw 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, which requires high privileges. The NVD text, copied from Zero Day Initiative advisory ZDI-23-1285, says the flaw is in the External User Lookup feature and that a user supplied string is used to execute Java code, with code running as SYSTEM.
The sources disagree. PaperCut's July 2023 bulletin lists ZDI-CAN-21013, the report ID NVD ties to this CVE, as a third party library update for the PostgreSQL support code (CVE-2022-21724), and says someone who already has administrator access could use it to gain further privileges. PaperCut's June 2023 bulletin instead says CVE-2023-39469 is the chained issue known as ZDI-CAN-20965, which it rates 6.5, and says it is fixed in 22.1.1. NVD ties ZDI-CAN-20965 to CVE-2023-39470. We report all of it and recommend you read both bulletins.
The July bulletin says all PaperCut NG and MF versions before 22.1.3 are vulnerable for the library update, and lists the fixed versions as 22.1.3 or later, 21.2.13 (and 21.2.14), and 20.1.9 (and 20.1.10). It says only the Application Server is impacted, and that site servers, secondary servers, Print Deploy, Mobility Print and the client software are not.
The weakness class is CWE-94 (improper control of generation of code). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Find the version of each PaperCut application server. In the administration web interface, the About page shows the version. The July 2023 bulletin says anything before 22.1.3 is affected, apart from the fixed 21.2.13 and 20.1.9 branches.
Then list the people who hold administrator accounts on PaperCut. Both readings of this CVE need an administrator login first, so account hygiene matters as much as the version.
What to do now
- Inventory every PaperCut NG and PaperCut MF application server and note the version.
- Upgrade to 22.1.3 or later, or to 21.2.13 or 20.1.9 and newer on those branches, as the July 2023 bulletin says. That covers the library update and the 22.1.1 hardening referenced in the June bulletin.
- Read the upgrade notes for the security properties file introduced in 22.1.1, since print scripting settings moved there and may need a decision.
- Limit administrator access to PaperCut to a short list of people, with strong passwords and multi factor authentication where your setup allows.
- Keep the PaperCut admin interface off the public internet.
Why it matters
Code injection means a value from a user is treated as code and run. The NVD text says the External User Lookup feature uses a user supplied string to execute Java code. PaperCut's bulletin describes the related July fix as a library update and a privilege gain for someone who already has admin access. Both versions of the story end with an administrator gaining more power than the application meant to give.
The administrator requirement is the main brake. It is also a weaker brake than it sounds, because print servers hold shared admin accounts and often sit on trusted networks. Treat the update as part of PaperCut's wider hardening series, and take it. The mismatch in sources is a good reason to rely on the vendor's fixed version list and not on any single CVE description.
Try it yourself
Two sources, two scores, one patch. This demo shows how a vulnerability management view keeps findings, scores and fixes in one place.
Click through it at your own pace, or open it full screen.
Quick check
Why do the sources disagree?
NVD ties this CVE to ZDI-CAN-21013 and the External User Lookup feature. PaperCut's June bulletin ties it to ZDI-CAN-20965 and a 6.5 score, and its July bulletin lists ZDI-CAN-21013 as a library update. We cannot tell which mapping is final, so we report all three.
Which version should I run?
22.1.3 or later, per the July 2023 bulletin, or the fixed releases on the 21.2 and 20.1 branches.
Sources
- Zero Day Initiative advisory ZDI-23-1285
- PaperCut NG/MF Security Bulletin, July 2023
- PaperCut NG/MF Security Bulletin, June 2023
- Safeguard Gold entry for CVE-2023-39469
Last reviewed: 19 October 2026.
