{"id":"CVE-2023-21415","aliases":["EUVD-2023-25583","GHSA-fp27-qfpm-95w8"],"status":"published","title":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del...","description":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00712,"percentile":0.541,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-35"],"published":"2023-10-16T06:24:13Z","modified":"2026-06-17T05:32:32Z","products":[{"vendor":"axis","product":"axis_os"},{"vendor":"axis","product":"axis_os_2016"},{"vendor":"axis","product":"axis_os_2018"},{"vendor":"axis","product":"axis_os_2020"},{"vendor":"axis","product":"axis_os_2022"},{"vendor":"axis communications ab","product":"axis os"}],"references":[{"url":"https://www.axis.com/dam/public/b6/55/e2/cve-2023-21415pdf-en-US-416245.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21415"},{"url":"https://www.axis.com/dam/public/58/0b/36/cve-2023-21415pdf-en-US-412759.pdf"},{"url":"https://github.com/advisories/GHSA-fp27-qfpm-95w8"}],"sources":{"cve":[{"id":"CVE-2023-21415","description":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.","status":"published","published":"2023-10-16T06:24:13.381Z","modified":"2024-11-08T08:33:59.027Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-35"],"updated_at":"2026-11-02T14:35:20.368244Z"}],"euvd":[{"id":"EUVD-2023-25583","description":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.","status":"published","published":"2023-10-16T06:24:13Z","modified":"2024-11-08T08:33:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:06.878478Z"}],"ghsa":[{"id":"GHSA-fp27-qfpm-95w8","title":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del...","description":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. \n","status":"published","published":"2023-10-16T09:30:18Z","modified":"2024-11-08T09:31:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-22","CWE-35"],"updated_at":"2026-11-02T14:58:46.386141Z"}],"nvd":[{"id":"CVE-2023-21415","description":"Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.","status":"published","published":"2023-10-16T07:15:08.76Z","modified":"2026-06-17T05:32:32.893Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-35","CWE-22"],"updated_at":"2026-11-02T14:08:37.83429Z"}]}}