Skip to content
Fencer Vulns
medium 5.5

CVE-2023-32360 json

An authentication issue was addressed with improved state management.

published 2023-06-23 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-36604

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents.

Patch / fix

  • Apple macOS 11.7, 12.6, 13.4
  • cups Debian 12 2.4.2-3+deb12u2
  • cups Debian 14, Debian 13 2.4.2-6

debian advisories DEBIAN-CVE-2023-32360

  • cups Ubuntu 20.04 LTS 2.3.1-9ubuntu1.5
  • cups Ubuntu 22.04 LTS 2.4.1op1-1ubuntu4.6
  • cups Ubuntu Pro 16.04 LTS 2.1.3-4ubuntu0.11+esm5
  • cups Ubuntu Pro 18.04 LTS 2.2.7-1ubuntu2.10+esm3

ubuntu advisories UBUNTU-CVE-2023-32360

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups RHEL 8 1:2.2.6-51.el8_8.1
  • cups-lpd RHEL 8 1:2.2.6-51.el8_8.1
  • cups-libs RHEL 8 1:2.2.6-51.el8_8.1
  • cups-client RHEL 8 1:2.2.6-51.el8_8.1
  • cups-ipptool RHEL 8 1:2.2.6-51.el8_8.1
  • cups-filesystem RHEL 8 1:2.2.6-51.el8_8.1
  • cups RHEL 9 1:2.3.3op2-16.el9_2.1
  • cups-lpd RHEL 9 1:2.3.3op2-16.el9_2.1

red hat advisories RHSA-2023:4864RHSA-2023:4838RHSA-2023:4766RHSA-2023:4765RHSA-2023:4771RHSA-2023:4768

  • cups Linux Micro 6.0 2.4.11-1.1
  • cups SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, SLE Module for Desktop Applications 15 SP5 +21 more 2.2.7-150000.3.51.2
  • cups SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 1.7.5-20.46.1

suse advisories SUSE-SU-2025:20090-1SUSE-SU-2023:3707-2SUSE-SU-2023:3707-1SUSE-SU-2023:3706-1

  • cups openSUSE Tumbleweed 2.4.2-7.1

opensuse advisories openSUSE-SU-2024:13250-1

  • cups AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups-lpd AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups-libs AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups-client AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups-ipptool AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups-filesystem AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups-printerapp AlmaLinux 9 1:2.3.3op2-16.el9_2.1
  • cups AlmaLinux 8 1:2.2.6-51.el8_8.1

almalinux advisories ALSA-2023:4838ALSA-2023:4864

  • cups Rocky Linux 9 1:2.3.3op2-16.el9_2.1
  • cups Rocky Linux 8 1:2.2.6-51.el8_8.1

rocky linux advisories RLSA-2023:4838RLSA-2023:4864

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-32360 updated cvss 6.5

cups: Information leak through Cups-Get-Document operation

  • Red Hat Enterprise Linux 6 cups, cups-lpd, cups-php, cups-libs
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) cups 2.2.6-51.el8_8.1, cups-lpd 2.2.6-51.el8_8.1, cups-client 2.2.6-51.el8_8.1, cups-ipptool 2.2.6-51.el8_8.1, cups-filesystem 2.2.6-51.el8_8.1
    fixed: vendor fix RHSA-2023:4864
  • Red Hat Enterprise Linux AppStream (v. 9) cups 2.3.3op2-16.el9_2.1, cups-lpd 2.3.3op2-16.el9_2.1, cups-client 2.3.3op2-16.el9_2.1, cups-ipptool 2.3.3op2-16.el9_2.1, cups-filesystem 2.3.3op2-16.el9_2.1, cups-printerapp 2.3.3op2-16.el9_2.1
    fixed: vendor fix RHSA-2023:4838
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) cups 2.2.6-33.el8_2.2, cups-lpd 2.2.6-33.el8_2.2, cups-client 2.2.6-33.el8_2.2, cups-ipptool 2.2.6-33.el8_2.2, cups-filesystem 2.2.6-33.el8_2.2
    fixed: vendor fix RHSA-2023:4771
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) cups 2.2.6-38.el8_4.2, cups-lpd 2.2.6-38.el8_4.2, cups-client 2.2.6-38.el8_4.2, cups-ipptool 2.2.6-38.el8_4.2, cups-filesystem 2.2.6-38.el8_4.2
    fixed: vendor fix RHSA-2023:4768
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) cups 2.2.6-28.el8_1.2, cups-lpd 2.2.6-28.el8_1.2, cups-client 2.2.6-28.el8_1.2, cups-ipptool 2.2.6-28.el8_1.2, cups-filesystem 2.2.6-28.el8_1.2
    fixed: vendor fix RHSA-2023:4765
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) cups 2.2.6-33.el8_2.2, cups-lpd 2.2.6-33.el8_2.2, cups-client 2.2.6-33.el8_2.2, cups-ipptool 2.2.6-33.el8_2.2, cups-filesystem 2.2.6-33.el8_2.2
    fixed: vendor fix RHSA-2023:4771
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) cups 2.2.6-38.el8_4.2, cups-lpd 2.2.6-38.el8_4.2, cups-client 2.2.6-38.el8_4.2, cups-ipptool 2.2.6-38.el8_4.2, cups-filesystem 2.2.6-38.el8_4.2
    fixed: vendor fix RHSA-2023:4768
show 16 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) cups 2.2.6-45.el8_6.3, cups-lpd 2.2.6-45.el8_6.3, cups-client 2.2.6-45.el8_6.3, cups-ipptool 2.2.6-45.el8_6.3, cups-filesystem 2.2.6-45.el8_6.3
    fixed: vendor fix RHSA-2023:4770
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) cups 2.3.3op2-13.el9_0.2, cups-lpd 2.3.3op2-13.el9_0.2, cups-client 2.3.3op2-13.el9_0.2, cups-ipptool 2.3.3op2-13.el9_0.2, cups-filesystem 2.3.3op2-13.el9_0.2, cups-printerapp 2.3.3op2-13.el9_0.2
    fixed: vendor fix RHSA-2023:4769
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) cups 2.2.6-33.el8_2.2, cups-lpd 2.2.6-33.el8_2.2, cups-client 2.2.6-33.el8_2.2, cups-ipptool 2.2.6-33.el8_2.2, cups-filesystem 2.2.6-33.el8_2.2
    fixed: vendor fix RHSA-2023:4771
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) cups 2.2.6-38.el8_4.2, cups-lpd 2.2.6-38.el8_4.2, cups-client 2.2.6-38.el8_4.2, cups-ipptool 2.2.6-38.el8_4.2, cups-filesystem 2.2.6-38.el8_4.2
    fixed: vendor fix RHSA-2023:4768
  • Red Hat Enterprise Linux BaseOS (v. 8) cups 2.2.6-51.el8_8.1, cups-libs 2.2.6-51.el8_8.1
    fixed: vendor fix RHSA-2023:4864
  • Red Hat Enterprise Linux BaseOS (v. 9) cups 2.3.3op2-16.el9_2.1, cups-libs 2.3.3op2-16.el9_2.1
    fixed: vendor fix RHSA-2023:4838
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) cups 2.2.6-33.el8_2.2, cups-libs 2.2.6-33.el8_2.2
    fixed: vendor fix RHSA-2023:4771
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) cups 2.2.6-38.el8_4.2, cups-libs 2.2.6-38.el8_4.2
    fixed: vendor fix RHSA-2023:4768
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) cups 2.2.6-28.el8_1.2, cups-libs 2.2.6-28.el8_1.2
    fixed: vendor fix RHSA-2023:4765
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) cups 2.2.6-33.el8_2.2, cups-libs 2.2.6-33.el8_2.2
    fixed: vendor fix RHSA-2023:4771
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4) cups 2.2.6-38.el8_4.2, cups-libs 2.2.6-38.el8_4.2
    fixed: vendor fix RHSA-2023:4768
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) cups 2.2.6-45.el8_6.3, cups-libs 2.2.6-45.el8_6.3
    fixed: vendor fix RHSA-2023:4770
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) cups 2.3.3op2-13.el9_0.2, cups-libs 2.3.3op2-13.el9_0.2
    fixed: vendor fix RHSA-2023:4769
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) cups 2.2.6-33.el8_2.2, cups-libs 2.2.6-33.el8_2.2
    fixed: vendor fix RHSA-2023:4771
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4) cups 2.2.6-38.el8_4.2, cups-libs 2.2.6-38.el8_4.2
    fixed: vendor fix RHSA-2023:4768
  • Red Hat Enterprise Linux Client (v. 7) cups 1.6.3-52.el7_9, cups-lpd 1.6.3-52.el7_9, cups-libs 1.6.3-52.el7_9, cups-client 1.6.3-52.el7_9, cups-filesystem 1.6.3-52.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) cups-ipptool 1.6.3-52.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) cups-ipptool 1.6.3-52.el7_9 Red Hat Enterprise Linux Server (v. 7) cups 1.6.3-52.el7_9, cups-lpd 1.6.3-52.el7_9, cups-libs 1.6.3-52.el7_9, cups-client 1.6.3-52.el7_9, cups-filesystem 1.6.3-52.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) cups-ipptool 1.6.3-52.el7_9 Red Hat Enterprise Linux Workstation (v. 7) cups 1.6.3-52.el7_9, cups-lpd 1.6.3-52.el7_9, cups-libs 1.6.3-52.el7_9, cups-client 1.6.3-52.el7_9, cups-filesystem 1.6.3-52.el7_9
    +1 more products
    Red Hat Enterprise Linux Workstation Optional (v. 7) cups-ipptool 1.6.3-52.el7_9
    fixed: vendor fix RHSA-2023:4766

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Apple macOS

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.