CVE-2023-32167: D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability
D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create or delete files in the context of SYSTEM. . Was ZDI-CAN-19529.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32167?
CVE-2023-32167 is considered a critical vulnerability due to its potential to allow remote file manipulation.
How do I fix CVE-2023-32167?
To fix CVE-2023-32167, update the D-Link D-View to the latest patched version provided by the vendor.
Who is affected by CVE-2023-32167?
CVE-2023-32167 affects installations of D-Link D-View that allow authentication for file operations.
What type of vulnerability is CVE-2023-32167?
CVE-2023-32167 is a directory traversal vulnerability that enables arbitrary file creation and deletion.
Is authentication required to exploit CVE-2023-32167?
Yes, authentication is required to exploit CVE-2023-32167.