CVE-2023-21412 - Vulnerability Details - OpenCVE

User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for
SQL injections.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Axis	License Plate Verifier

Configuration 1 [-]

cpe:2.3:a:axis:license_plate_verifier:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-25580	User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf

History

Fri, 08 Nov 2024 08:45:00 +0000

Type	Values Removed	Values Added
Description	User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.	User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.

Thu, 17 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Axis

Published: 2023-08-03T06:56:00.673Z

Updated: 2024-11-08T08:30:14.825Z

Reserved: 2022-11-04T18:30:01.767Z

Link: CVE-2023-21412

Vulnrichment

Updated: 2024-08-02T09:36:34.515Z

NVD

Status : Modified

Published: 2023-08-03T07:15:13.097

Modified: 2024-11-21T07:42:48.663

Link: CVE-2023-21412

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-21412", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "state": "PUBLISHED", "assignerShortName": "Axis", "dateReserved": "2022-11-04T18:30:01.767Z", "datePublished": "2023-08-03T06:56:00.673Z", "dateUpdated": "2024-11-08T08:30:14.825Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AXIS License Plate Verifier", "vendor": "Axis Communications AB", "versions": [{"status": "affected", "version": "2.8.3 or earlier"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "User provided input is not sanitized on the AXIS License Plate Verifier specific \u201csearch.cgi\u201d allowing for\nSQL injections."}], "value": "User provided input is not sanitized on the AXIS License Plate Verifier specific \u201csearch.cgi\u201d allowing for\nSQL injections."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2024-11-08T08:30:14.825Z"}, "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf"}], "source": {"discovery": "UNKNOWN"}, "title": "Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:36:34.515Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-17T15:36:52.971290Z", "id": "CVE-2023-21412", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T15:37:01.347Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:36:34.515Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-21412", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-17T15:36:52.971290Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T15:36:57.507Z"}}], "cna": {"title": "Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Axis Communications AB", "product": "AXIS License Plate Verifier", "versions": [{"status": "affected", "version": "2.8.3 or earlier"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.axis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "User provided input is not sanitized on the AXIS License Plate Verifier specific \u201csearch.cgi\u201d allowing for\nSQL injections.", "supportingMedia": [{"type": "text/html", "value": "User provided input is not sanitized on the AXIS License Plate Verifier specific \u201csearch.cgi\u201d allowing for\nSQL injections.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis", "dateUpdated": "2024-11-08T08:30:14.825Z"}}}, "cveMetadata": {"cveId": "CVE-2023-21412", "state": "PUBLISHED", "dateUpdated": "2024-11-08T08:30:14.825Z", "dateReserved": "2022-11-04T18:30:01.767Z", "assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "datePublished": "2023-08-03T06:56:00.673Z", "assignerShortName": "Axis"}, "dataVersion": "5.1"}