CVE-2023-32137

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-32137
D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. . Was ZDI-CAN-18415.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-529/ Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-529/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-1360_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-1360:f1:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:dlink:dap-2020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2020:a2:*:*:*:*:*:*:*
History

16 May 2025, 19:11

Type Values Removed Values Added
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 - Patch, Vendor Advisory
References () https://www.zerodayinitiative.com/advisories/ZDI-23-529/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-529/ - Third Party Advisory
CPE cpe:2.3:o:dlink:dap-2020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dap-1360_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2020:a2:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-1360:f1:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 6.5
First Time Dlink
Dlink dap-2020
Dlink dap-1360 Firmware
Dlink dap-1360
Dlink dap-2020 Firmware

21 Nov 2024, 08:02

Type Values Removed Values Added
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 -
References () https://www.zerodayinitiative.com/advisories/ZDI-23-529/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-529/ -

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary
  • (es) D-Link DAP-1360 webproc WEB_DisplayPage Vulnerabilidad de divulgación de información Directory Traversal. Esta vulnerabilidad permite a atacantes adyacentes a la red revelar información confidencial sobre las instalaciones afectadas de los enrutadores D-Link DAP-1360. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe en el manejo de solicitudes al endpoint /cgi-bin/webproc. El problema se debe a la falta de validación adecuada de una ruta proporcionada por el usuario antes de usarla en operaciones de archivos. Un atacante puede aprovechar esta vulnerabilidad para revelar información en el contexto de la raíz. Era ZDI-CAN-18415.
Summary (en) D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-18415. (en) D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. . Was ZDI-CAN-18415.

03 May 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2025-05-16 19:11

NVD link : CVE-2023-32137

Mitre link : CVE-2023-32137

CVE.ORG link : CVE-2023-32137

JSON object : View

Products Affected

dlink

  • dap-2020_firmware
  • dap-1360_firmware
  • dap-2020
  • dap-1360
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')