CVE-2024-0067 — Path Traversal: '.../...//' in Communications AB Axis OS

CWE-35 — Path Traversal: '.../...//'CWE-22 — Path Traversal3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 54.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Axis Communications AB Axis OS
Timeline
PublishedSep 10

Description

Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5axis_communications_ab/axis_os8.40 - 11.10

🔴Vulnerability Details

2
GHSA
GHSA-g385-hxmr-ghgc: Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit↗2024-09-10
▶
CVEList
CVE-2024-0067: Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit↗2024-09-10
▶
CVE-2024-0067 — Path Traversal: '.../...//' | cvebase