D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability
CVE-2023-32168

8.8HIGH

Key Information:

Vendor
D-link
Status
D-view
Vendor
CVE Published:
3 May 2024

Summary

The D-Link D-View product contains a vulnerability stemming from improper authorization within the showUser method, which opens the door for remote attackers to exploit it and escalate their privileges. This flaw allows unauthorized access to sensitive resources generally off-limits to standard users. To successfully exploit this vulnerability, an attacker must authenticate to the system, thus adding a layer of complexity to the exploitation process. This vulnerability showcases the critical need for stringent authorization checks in software implementations to safeguard against unauthorized access and protect sensitive data.

Affected Version(s)

D-View DLink D-View8 1.0.2.13

References

https://www.zerodayinitiative.com/advisories/ZDI-23-719/
x_research-advisory
https://supportannouncement.us.dlink.com/announcement/pub...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.