CVE-2023-21415: Path Traversal
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlaydel.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-21415?
CVE-2023-21415 is a vulnerability in the VAPIX API overlay_del.cgi in AXIS OS that allows for path traversal attacks and file deletion.
How severe is CVE-2023-21415?
CVE-2023-21415 has a severity rating of 8.1, which is considered high.
Which software versions are affected by CVE-2023-21415?
CVE-2023-21415 affects AXIS OS versions 6.50.5.3 to 6.50.5.14, 11.0.81 to 11.6.94, 6.50.2 to 6.50.5.2, 8.40.35, 9.80.47, 10.12.206, and all their LTS versions.
How can I exploit CVE-2023-21415?
To exploit CVE-2023-21415, an attacker needs to authenticate with an operator- or administrator-privileged service account.
Is there a fix for CVE-2023-21415?
Axis has released a security advisory providing mitigation steps for CVE-2023-21415, which can be found at the provided reference link.