What is CVE-2023-47313?

CVE-2023-47313 is a medium-severity vulnerability in H-Mdm Headwind Mdm, classified under Path Traversal. CVSS score: 5.4/10. Published 2023-11-22.

How severe is CVE-2023-47313?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Path Traversal in H-Mdm Headwind Mdm

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.008 (52.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

H-mdm Headwind_mdm — versions 5.22.1
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-47313?: CVE-2023-47313 is a medium-severity vulnerability in H-Mdm Headwind Mdm, classified under Path Traversal. CVSS score: 5.4/10. Published 2023-11-22.
How severe is CVE-2023-47313?: Medium severity. CVSS v3 base score is 5.4 out of 10.