CVE-2023-21417

CWE-35CWE-22 — Path Traversal3 documents3 sources
Severity
7.1HIGH
EPSS
0.2%
top 58.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Axis Axis OSAxis Axis OS 2020Axis Axis OS 2022+1 more
Timeline
PublishedNov 21

Description

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account. The impact of exploiting this vulnerability is lower with operator service accounts and limited to non-system files compared to administrator-privileges. Axis has released patched AXIS OS version…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:HExploitability: 2.8 | Impact: 4.2

Affected Packages4 packages

▶NVDaxis/axis_os< 11.7.57
▶NVDaxis/axis_os_2020< 9.80.49
▶NVDaxis/axis_os_2022< 10.12.208
▶CVEListV5axis_communications_ab/axis_osAXIS OS 8.50 – 11.6

🔴Vulnerability Details

2
GHSA
GHSA-967w-79j9-vx4x: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage↗2023-11-21
▶
CVEList
CVE-2023-21417: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage↗2023-11-21
▶