CVE-2023-47313 — MEDIUM (5.4)

Vulnerability Description

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
H-Mdm	Headwind Mdm	5.22.1

Related Weaknesses (CWE)

CWE-22

References

https://boltonshield.com/en/cve/cve-2023-47313/ExploitThird Party Advisory
https://boltonshield.com/en/cve/cve-2023-47313/ExploitThird Party Advisory

FAQ

What is CVE-2023-47313?

CVE-2023-47313 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API ...

How severe is CVE-2023-47313?

CVE-2023-47313 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-47313?

Check the references section above for vendor advisories and patch information. Affected products include: H-Mdm Headwind Mdm.