Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.
References
| Link | Resource |
|---|---|
| https://boltonshield.com/en/cve/cve-2023-47313/ | Exploit Third Party Advisory |
Configurations
History
30 Nov 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded. |
30 Nov 2023, 05:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://boltonshield.com/en/cve/cve-2023-47313/ - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:h-mdm:headwind_mdm:5.22.1:*:*:*:*:*:*:* |
22 Nov 2023, 17:31
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-22 17:15
Updated : 2024-02-05 00:22
NVD link : CVE-2023-47313
Mitre link : CVE-2023-47313
CVE.ORG link : CVE-2023-47313
JSON object : View
Products Affected
h-mdm
- headwind_mdm
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')