CVE-2023-44412
Published: 03 May 2024
Summary
CVE-2023-44412 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Dlink D-View 8. Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-44412 is an XML External Entity (XXE) vulnerability in the addDv7Probe function of D-Link D-View. The flaw stems from improper restriction of XXE references in the XML parser, allowing a crafted document with an external URI to cause the parser to retrieve and embed external content. The issue affects D-Link D-View installations and carries a CVSS 3.0 score of 8.2 with CWE-611.
Remote attackers can exploit the vulnerability without authentication by sending a malicious XML payload to the affected function. Successful exploitation enables disclosure of sensitive information from the target system in the context of the SYSTEM account, with a secondary impact on availability.
The associated Zero Day Initiative advisory ZDI-23-1510 documents the issue as ZDI-CAN-19571 but provides no further mitigation details in the available references. The EPSS score has remained flat at 0.0911 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48752
Vulnerability details
D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the addDv7Probe…
more
function. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19571.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.