CVE-2023-21415

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

0.59%

Published

Oct 16, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-35CWE-22

Affected Products (6)

axis · axis_os (up to 6.50.5.14)vulnerable

axis · axis_os (up to 11.6.94)vulnerable

axis · axis_os_2016 (up to 6.50.5.2)vulnerable

axis · axis_os_2018 (up to 8.40.35)vulnerable

axis · axis_os_2020 (up to 9.80.47)vulnerable

axis · axis_os_2022 (up to 10.12.206)vulnerable

References (2)

https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf

Vendor Advisory

https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs