Vulnerability-Lookup

VAR-200302-0055

Vulnerability from variot - Updated: 2022-05-17 01:46

It has been reported that the Axis Video Servers do not properly handle input to the 'command.cgi' script. Because of this, an attacker may be able to create arbitrary files that would result in a denial of service, or potentially command execution.

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200302-0055",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "communications network camera",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24202.33"
      },
      {
        "model": "communications network camera",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24202.32"
      },
      {
        "model": "communications network camera",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24202.31"
      },
      {
        "model": "communications network camera",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24202.12"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24012.33"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24012.32"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24012.31"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24012.20"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24002.33"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24002.32"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24002.31"
      },
      {
        "model": "communications video server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "24002.20"
      },
      {
        "model": "communications ptz network camera",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "axis",
        "version": "21302.32"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Discovery credited to Martin Eiszner \u003cmartin@websec.org\u003e.",
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ],
    "trust": 0.3
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "It has been reported that the Axis Video Servers do not properly handle input to the \u0027command.cgi\u0027 script.  Because of this, an attacker may be able to create arbitrary files that would result in a denial of service, or potentially command execution.",
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ],
    "trust": 0.3
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "6987",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ]
  },
  "id": "VAR-200302-0055",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.44047618
  },
  "last_update_date": "2022-05-17T01:46:09.985000Z",
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 0.3,
        "url": "http://www.axis.com/products/camera_servers/index.htm"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/316184"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/313485"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "6987"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2003-02-28T00:00:00",
        "db": "BID",
        "id": "6987"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2003-02-28T00:00:00",
        "db": "BID",
        "id": "6987"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Axis Communications Video Server Command.CGI File Creation Vulnerability",
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ],
    "trust": 0.3
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Input Validation Error",
    "sources": [
      {
        "db": "BID",
        "id": "6987"
      }
    ],
    "trust": 0.3
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-200302-0055

Tags

Sightings

Nomenclature