CVE-2023-32167: fallo de gravedad media en D-Link D-View
D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
35Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 75%
D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create or delete files in the context of SYSTEM.
. Was ZDI-CAN-19529.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Productos afectados
D-Link · D-ViewCVEs relacionadas — D-Link D-View
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-32164HIGHD-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityEPSS 84.9%CVE-2023-44412HIGHD-Link D-View addDv7Probe XML External Entity Processing Information Disclosure VulnerabilityEPSS 82.3%CVE-2023-32166HIGHD-Link D-View uploadFile Directory Traversal Arbitrary File Creation VulnerabilityEPSS 74.3%CVE-2023-32165CRITICALD-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution VulnerabilityEPSS 73.3%CVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.9%