CVE-2023-44410CWE-285

D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability

High · published May 3, 2024

CVSS v3.0
8.8
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.

The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.

. Was ZDI-CAN-19535.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01585 · 75.4th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-05-03T02:13Z
EPSS history
Timeline
  • 03 MAY 02:13Z
    D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability
    cvelistv5