D-Link D-View Dir Traversal & Arbitrary File Creation (Auth Required)
CVE-2023-32166 Published on May 3, 2024

D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability
D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadFile function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of SYSTEM. Was ZDI-CAN-19527.

Vendor Advisory NVD

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2023-32166 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2023-32166

Want to know whenever a new CVE is published for D-Link D View 8? stack.watch will email you.

D-Link D View 8
 

Affected Versions

D-Link D-View Version DLink D-View8 1.0.2.13 is affected by CVE-2023-32166

Exploit Probability

EPSS
43.65%
Percentile
97.46%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.