CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal

published November 22, 2023

CVSS
—
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00786 · 55.4th percentile
Published
2023-11-22T00:00Z
EPSS history
Timeline
  • 22 NOV 00:00Z
    Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal
    cvelistv5