PT-2017-6114 · D Link+1 · D-Link Dns-320+2

CVE-2014-7860

·

Publicado

2017-08-25

·

Atualizado

2023-04-26

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions: D-Link DNS-320L versions prior to 1.04b12 D-Link DNS-327L versions prior to 1.03b04 Build0119
Description: The issue allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album id and access token. This is due to the lack of authentication for requests in the web/web file/fb publish.php script.
Recommendations: For D-Link DNS-320L versions prior to 1.04b12, update to version 1.04b12 or later. For D-Link DNS-327L versions prior to 1.03b04 Build0119, update to version 1.03b04 Build0119 or later.

Correção

Information Disclosure

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200CWE-287

Identificadores relacionados

CVE-2014-7860

Produtos afetados

D-Link Dns-320
D-Link Dns-327L
Facebook