ZDI-CAN-19535: ZDI-23-1508: (0Day) D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
Other sources
This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-44410.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-19535?
The severity of ZDI-CAN-19535 is considered high due to its potential for privilege escalation.
How do I fix ZDI-CAN-19535?
To fix ZDI-CAN-19535, D-Link recommends updating to the latest version of D-View that addresses this vulnerability.
Who is affected by ZDI-CAN-19535?
ZDI-CAN-19535 affects installations of D-Link D-View that do not have the necessary security updates applied.
Can ZDI-CAN-19535 be exploited remotely?
Yes, ZDI-CAN-19535 can be exploited remotely, but authentication is required to initiate the attack.
What is the nature of the vulnerability in ZDI-CAN-19535?
ZDI-CAN-19535 involves a lack of proper authorization within the showUsers method of D-Link D-View, allowing for privilege escalation.