CVE-2023-32168CWE-285

D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability

High · published May 3, 2024

CVSS v3.0
8.8
EPSS
2%
Percentile
76.1
In the wild
Unconfirmed
What it is

D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.

The specific flaw exists within the showUser method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.

. Was ZDI-CAN-19534.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01633 · 76.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-05-03T01:56Z
EPSS history
Timeline
  • 03 MAY 01:56Z
    D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability
    cvelistv5