CVE-2023-32167

🎯 CVE-2023-32167 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2023-32167 | D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker ca

D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.

The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create or delete files in the context of SYSTEM.
. Was ZDI-CAN-19529.

Klassifikation & Betroffenheit:

CWE-22 D-Link D-View DLink D-View8 1.0.2.13

Improper Limitation of a Pathname to a Restricted Directory 🎯 High

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

🛡️ Empfohlene Mitigation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-64 · Using Slashes and URL Encoding Combined … (High) CAPEC-76 · Manipulating Web Input to File System Ca… (Very High) CAPEC-78 · Using Escaped Slashes in Alternate Encod… (High) CAPEC-79 · Using Slashes in Alternate Encoding (High) CAPEC-126 · Path Traversal (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-105816 8.0 CVE-2026-15801 8.0 CVE-2026-69807 8.0 CVE-2026-4858 8.0 CVE-2026-33183 8.0

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2023

Veröffentlicht 05/2024

Heute 04.11.

CVSS-Vektor-Analyse: 6.5

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Keine

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CNA-Bewertung (zdi): 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Veröffentlicht:03.05.2024

Aktualisiert:05.02.2025 20:37

Assigner (CNA):zdi

EUVD-ID:EUVD-2023-36435

EPSS-Verlauf (41 Messungen)

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	764	0,2 %
≥50 %	3.405	0,9 %
≥10 %	22.628	5,7 %
<10 %	368.443	93,2 %

6.5 MEDIUM

EPSS

74.9%

CVE-2023-32167 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

D-Link

CVE-2023-32167 | D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker ca

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 2 Jahren ↻ vor 1 Jahr

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub