CVE-2023-27168 File upload in n/a

Critical 9.8 Published 19 Jan 2024 Updated 16 Sep 2026

Attackers can execute arbitrary code by uploading a crafted JSP file to the Write-back Manager application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-27168?

CVE-2023-27168 is a critical vulnerability in n/a, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file.

Weakness: CWE-434

Which versions are affected by CVE-2023-27168?

It affects 1 product.

Products include Xpand-It Write-Back Manager.

How do I fix CVE-2023-27168?

No fix has been published for CVE-2023-27168 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-27168 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27168 exists.

Sources

Also known as GHSA-949j-r9x2-w58x.