CVE-2023-47315

Published Nov 22, 2023

Last updated a year ago

Overview

Description: Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-798

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:h-mdm:headwind_mdm:5.22.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "74956AFE-5BBC-40AA-97A4-61F4E2A595FC"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References