Lucene search
PRIOn knowledge basePRION:CVE-2023-47313HistoryNov 22, 2023 - 5:15 p.m.
Directory traversal
2023-11-2217:15:00
PRIOn knowledge base
www.prio-n.com
5
directory traversal
api call
file upload
vulnerability
arbitrary files
Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.
| CPE | Name | Operator | Version |
|---|---|---|---|
| headwind_mdm | eq | 5.22.1 |
References
Related
nvd
nvd
CVE-2023-47313
2023-11-22 17:15:22
cve
cve
CVE-2023-47313
2023-11-22 17:15:22
cvelist
cvelist
CVE-2023-47313
2023-11-22 00:00:00