CVE-2023-32164: falha de alta gravidade em D-Link D-View
D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
43Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 85%
D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the TftpSendFileThread class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19496.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
D-Link · D-ViewCVEs relacionadas — D-Link D-View
No mesmo produto, das mais perigosas para as menos.
CVE-2023-44412HIGHD-Link D-View addDv7Probe XML External Entity Processing Information Disclosure VulnerabilityEPSS 82.3%CVE-2023-32167MEDIUMD-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion VulnerabilityEPSS 74.9%CVE-2023-32166HIGHD-Link D-View uploadFile Directory Traversal Arbitrary File Creation VulnerabilityEPSS 74.3%CVE-2023-32165CRITICALD-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution VulnerabilityEPSS 73.3%CVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.9%