PT-2023-6102 · D Link · D-Link D-View

Rgod · Published 2023-10-04 · Updated 2024-05-04 · CVE-2023-44412

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions D-Link D-View versions (affected versions not specified)

Description The issue is related to the addDv7Probe function and involves improper restriction of XML External Entity (XXE) references. This allows remote attackers to disclose sensitive information on affected installations without requiring authentication. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM by crafting a document that specifies a URI, causing the XML parser to access the URI and embed its contents back into the XML document.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-06807

CVE-2023-44412

ZDI-23-1510

Affected Products

D-Link D-View

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-44412 · Security Note
• https://bdu.fstec.ru/vul/2023-06807 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44412 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1510 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2023-10-06.1.pdf · Security Note
• https://vuldb.com/?id.241371 · Note
• https://twitter.com/CVEnew/status/1786770975297536391 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-19571 · Note