CVE-2014-7860 Missing authorization in n/a
Remote attackers can access and publish arbitrary photos to Facebook profiles without authentication due to missing checks in the publish script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-7860?
CVE-2014-7860 is a medium-severity missing authorization vulnerability in n/a, published on 25 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token.
Which versions are affected by CVE-2014-7860?
It affects 2 products.
Products include D-Link Dns-320l Firmware, D-Link Dns-327l Firmware.
How do I fix CVE-2014-7860?
No fix has been published for CVE-2014-7860 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-7860 being exploited?
There is no known exploitation of CVE-2014-7860 in the wild and no public exploit code.
Sources
Also known as GHSA-gmcr-cvch-ppg6.