CVE-2023-21415

CWE-35CWE-22 — Path Traversal3 documents3 sources
Severity
8.1HIGH
EPSS
0.1%
top 67.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Axis Axis OSAxis Axis OS 2016Axis Axis OS 2018+3 more
Timeline
PublishedOct 16

Description

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶NVDaxis/axis_os6.50.5.3 — 6.50.5.14+1
▶NVDaxis/axis_os_20166.50.2 — 6.50.5.2
▶NVDaxis/axis_os_2018< 8.40.35
▶NVDaxis/axis_os_2020< 9.80.47
▶NVDaxis/axis_os_2022< 10.12.206

🔴Vulnerability Details

2
GHSA
GHSA-fp27-qfpm-95w8: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del↗2023-10-16
▶
CVEList
CVE-2023-21415: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del↗2023-10-16
▶