Overview
- Description
- The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token.
- Source
- cve@mitre.org
- NVD status
- Modified
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
- nvd@nist.gov
- CWE-200
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:d-link:dns-327l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABE0BD7C-20B3-42BF-8DFA-4866B797C320",
"versionEndIncluding": "1.02"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DB305B29-7F89-4A52-9ECF-3DB0BDD2350D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:d-link:dns-320l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67E4E8C9-D8DF-46DF-A6B8-9E0DAA8ED78C",
"versionEndIncluding": "1.03b04"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6C677E53-6885-4EC4-A7CC-E24E8F445F59"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]