CVE-2023-21411 - Vulnerability Details - OpenCVE

User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for
arbitrary code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Axis	License Plate Verifier

Configuration 1 [-]

cpe:2.3:a:axis:license_plate_verifier:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-25579	User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf

History

Fri, 08 Nov 2024 08:45:00 +0000

Type	Values Removed	Values Added
Description	User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.	User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.
Weaknesses		CWE-78

Thu, 17 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Axis

Published: 2023-08-03T06:54:00.361Z

Updated: 2024-11-08T08:29:24.001Z

Reserved: 2022-11-04T18:30:01.767Z

Link: CVE-2023-21411

Vulnrichment

Updated: 2024-08-02T09:36:34.454Z

NVD

Status : Modified

Published: 2023-08-03T07:15:13.003

Modified: 2024-11-21T07:42:48.547

Link: CVE-2023-21411

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-21411", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "state": "PUBLISHED", "assignerShortName": "Axis", "dateReserved": "2022-11-04T18:30:01.767Z", "datePublished": "2023-08-03T06:54:00.361Z", "dateUpdated": "2024-11-08T08:29:24.001Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AXIS License Plate Verifier", "vendor": "Axis Communications AB", "versions": [{"status": "affected", "version": "2.8.3 or earlier"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "User provided input is not sanitized in the \u201cSettings > Access Control\u201d configuration interface allowing for\narbitrary code execution."}], "value": "User provided input is not sanitized in the \u201cSettings > Access Control\u201d configuration interface allowing for\narbitrary code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2024-11-08T08:29:24.001Z"}, "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf"}], "source": {"discovery": "UNKNOWN"}, "title": "Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:36:34.454Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-17T15:37:31.867390Z", "id": "CVE-2023-21411", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T15:37:43.186Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:36:34.454Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-21411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-17T15:37:31.867390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T15:37:39.677Z"}}], "cna": {"title": "Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Axis Communications AB", "product": "AXIS License Plate Verifier", "versions": [{"status": "affected", "version": "2.8.3 or earlier"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "User provided input is not sanitized in the \u201cSettings > Access Control\u201d configuration interface allowing for\narbitrary code execution.", "supportingMedia": [{"type": "text/html", "value": "User provided input is not sanitized in the \u201cSettings > Access Control\u201d configuration interface allowing for\narbitrary code execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2024-11-08T08:29:24.001Z"}}}, "cveMetadata": {"cveId": "CVE-2023-21411", "state": "PUBLISHED", "dateUpdated": "2024-11-08T08:29:24.001Z", "dateReserved": "2022-11-04T18:30:01.767Z", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "datePublished": "2023-08-03T06:54:00.361Z", "assignerShortName": "Axis"}, "dataVersion": "5.1"}