CVE-2023-27168
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted JSP file. An attacker can upload a malicious file that gets executed on the server.
Risk Assessment
Risk of remote code execution on the server, potentially leading to full system and data compromise. An attacker could take control of the application and server.
Recommendation
Update Xpand IT Write-back Manager to the latest version that fixes this vulnerability. Restrict file uploads to trusted users and validate file types.
Other vulnerabilities in Xpand IT Write-back Manager
See all- CVE-2023-27172Critical
Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key via a brute-force attack, enabling token forgery and unauthorized access.
- CVE-2023-27170High
Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter. This may enable access to files outside the intended directory.
- CVE-2023-27169Medium
Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in the license class configuration, leading to the generation of hardcoded and predictable symmetric encryption keys for license generation and validation. This allows an attacker to reconstruct the keys and forge licenses.
Original NVD description (English source)
An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file.