CVE-2023-47314

Summary

CVE-2023-47314 is a cross-site scripting (XSS) vulnerability affecting Headwind MDM Web panel version 5.22.1. The file upload function in this software is the source of the issue, enabling attackers to upload APK and arbitrary files. By exploiting this flaw, adversaries can upload malicious HTML files and share the download links with intended victims. Since the file download feature returns files in inline mode, the victim's browser instantly renders the content as a web page, making it possible for the uploaded client-side code to be executed in the victim's browser. This scenario allows attackers to carry out common XSS attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.