CVE-2023-44410 D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability

2024-05-0302:13:41

CWE-285

zdi

raw.githubusercontent.com

cve-2023-44410

d-link d-view

privilege escalation

remote attack

authentication

zdi-can-19535

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.

The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-19535.