Windows Admin Center
CVE-2023-29347
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Windows Admin Center Spoofing Vulnerability
AnalysisAI
Windows Admin Center Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Affected products include: Microsoft Windows Admin Center.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today