Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
References
| Link | Resource |
|---|---|
| https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Oct 2023, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:axis:axis_os_2022:*:*:*:*:lts:*:*:* cpe:2.3:o:axis:axis_os_2018:*:*:*:*:lts:*:*:* cpe:2.3:o:axis:axis_os_2016:*:*:*:*:lts:*:*:* cpe:2.3:o:axis:axis_os:*:*:*:*:-:*:*:* cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:* cpe:2.3:o:axis:axis_os_2020:*:*:*:*:lts:*:*:* |
|
| First Time |
Axis axis Os
Axis axis Os 2022 Axis axis Os 2016 Axis axis Os 2018 Axis axis Os 2020 Axis |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| References | (MISC) https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf - Vendor Advisory | |
| CWE | CWE-22 |
19 Oct 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
16 Oct 2023, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-16 07:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-21415
Mitre link : CVE-2023-21415
CVE.ORG link : CVE-2023-21415
JSON object : View
Products Affected
axis
- axis_os
- axis_os_2022
- axis_os_2016
- axis_os_2020
- axis_os_2018
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')