CVE-2023-32168: d-link d-view Improper Authorization

Vulnerability summary

CVE-2023-32168 is a high (CVSS 8.8) Improper Authorization vulnerability in d-link d-view. EPSS estimates a 1.63% chance of exploitation in the next 30 days, higher than 75.9% of scored vulnerabilities.

Timeline

1. 03-05-2024
   PublishedVulnerability first disclosed.
2. 18-09-2024
   Last modifiedVulnerability information updated.

Description

D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the showUser method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. . Was ZDI-CAN-19534.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.