CVE-2023-29347
published 2023-07-11CVE-2023-29347: Windows Admin Center Spoofing Vulnerability Windows Admin Center Spoofing Vulnerability
medium6.8CVSS 3.1
AVNACLPRLUIRSCCNIHAN
EPSS
1.88%
77.0th percentile
Windows Admin Center Spoofing Vulnerability
Windows Admin Center Spoofing Vulnerability
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_admin_center | >= 1809.0 < 2306 | 2306 |
| msrc | windows_admin_center | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
cvelistv58.7HIGH
vendor_msrc8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Admin Center Spoofing Vulnerability
vendor_msrc·2023-07-11·CVSS 8.7
CVE-2023-29347 [HIGH] CWE-79 Windows Admin Center Spoofing Vulnerability
Windows Admin Center Spoofing Vulnerability
FAQ: Where can customer obtain the updated software?
Customers can download the latest build of Windows Admin Center by using this link: aka.ms/downloadwac
FAQ: According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.
FAQ: How could an attacker exploit this vulnerability?
An authenticated attacker could exploit the vulnerability by carrying out any one of the following actions:
Importing a malicious script to the Windows Admin Center (WAC) HTML form.
Importing a .csv file using the Windows Admin Center (WAC) user interface.
Importing a .csv file using
CVEList
Windows Admin Center Spoofing Vulnerability
cvelistv5·2023-07-11·CVSS 8.7
CVE-2023-29347 [HIGH] CWE-79 Windows Admin Center Spoofing Vulnerability
Windows Admin Center Spoofing Vulnerability
Windows Admin Center Spoofing Vulnerability
No detection rules found.
No public exploits indexed.
2023-07-11
Published