CVE-2023-21407 Privilege escalation in AXIS License Plate Verifier ACAP
An attacker with operator access can escalate privileges to administrator due to broken access control in AXIS License Plate Verifier.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-21407?
CVE-2023-21407 is a high-severity vulnerability in AXIS License Plate Verifier, published on 3 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
Which versions are affected by CVE-2023-21407?
It affects 1 product.
Products include Axis License Plate Verifier.
How do I fix CVE-2023-21407?
No fix has been published for CVE-2023-21407 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-21407 being exploited?
There is no known exploitation of CVE-2023-21407 in the wild and no public exploit code.
Other vulnerabilities in AXIS License Plate Verifier
- CVE-2023-21408 Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP
- CVE-2023-21409 Insufficient file permissions leak administrator-privileged credentials in AXIS License Verifier ACAP
- CVE-2023-21410 Non-sanitized user input could lead to arbitrary code execution in AXIS License Plate Verifier
- CVE-2023-21411 Command injection in AXIS License Plate Verifier
- CVE-2023-21412 Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier
Sources
Also known as GHSA-wcv8-pxmf-r35j.