CVE-2023-21415: Path Traversal
First published: Mon Oct 16 2023(Updated: )
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Credit: product-security@axis.com product-security@axis.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Axis Axis Os | >=6.50.5.3<6.50.5.14 | |
| Axis Axis Os | >=11.0.81<11.6.94 | |
| Axis Axis Os 2016 | >=6.50.2<6.50.5.2 | |
| Axis Axis Os 2018 | <8.40.35 | |
| Axis Axis Os 2020 | <9.80.47 | |
| Axis Axis Os 2022 | <10.12.206 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-21415?
CVE-2023-21415 is a vulnerability in the VAPIX API overlay_del.cgi in AXIS OS that allows for path traversal attacks and file deletion.
How severe is CVE-2023-21415?
CVE-2023-21415 has a severity rating of 8.1, which is considered high.
Which software versions are affected by CVE-2023-21415?
CVE-2023-21415 affects AXIS OS versions 6.50.5.3 to 6.50.5.14, 11.0.81 to 11.6.94, 6.50.2 to 6.50.5.2, 8.40.35, 9.80.47, 10.12.206, and all their LTS versions.
How can I exploit CVE-2023-21415?
To exploit CVE-2023-21415, an attacker needs to authenticate with an operator- or administrator-privileged service account.
Is there a fix for CVE-2023-21415?
Axis has released a security advisory providing mitigation steps for CVE-2023-21415, which can be found at the provided reference link.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-api
- collector/nvd-index
- vendor/axis
- canonical/axis axis os
- version/axis axis os/6.50.5.3
- version/axis axis os/11.0.81
- canonical/axis axis os 2016
- version/axis axis os 2016/6.50.2
- canonical/axis axis os 2018
- canonical/axis axis os 2020
- canonical/axis axis os 2022