CVE-2023-44410: d-link d-view Improper Authorization

Vulnerability summary

CVE-2023-44410 is a high (CVSS 8.8) Improper Authorization vulnerability in d-link d-view. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.2% of scored vulnerabilities.

Timeline

1. 03-05-2024
   PublishedVulnerability first disclosed.
2. 20-09-2024
   Last modifiedVulnerability information updated.

Description

D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. . Was ZDI-CAN-19535.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.