PT-2023-30411 · Headwind · Headwind Mdm Web Panel

Published 2023-11-22 · Updated 2023-11-30 · CVE-2023-47314

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Headwind MDM Web panel version 5.22.1

Description The issue allows attackers to upload arbitrary files, including HTML files, to the server. When a victim downloads and opens one of these files, their browser renders the content as a web page, executing any client-side code contained within. This enables attackers to perform common cross-site scripting (XSS) attacks by sharing the download URL with victims. The file upload function, specifically allowing APK and arbitrary files, is the entry point for this issue.

Recommendations For Headwind MDM Web panel version 5.22.1, consider disabling the file upload function temporarily to prevent exploitation until a patch is available. Restrict access to the file download function to minimize the risk of attackers sharing malicious HTML files. Avoid using the file upload feature for sensitive operations until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47314

Affected Products

Headwind Mdm Web Panel

References · 5

• 🔥 https://boltonshield.com/en/cve/cve-2023-47314 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-47314 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47314 · Vendor Advisory
• https://t.me/cvenotify/61797 · Telegram Post
• https://t.me/cvenotify/61590 · Telegram Post