Paper/Archive/CVE-2023-21408

CVE-2023-21408

Axis Communications AB AXIS License Plate Verifier — Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 50.4.504 × 2010.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems.

Affected

ProductAffectedFixed inSource

AXIS License Plate Verifier2.8.3 or earlier–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Axis (CNA)8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaxis.com/dam/public/0b/1c/96/cve-2023-2140712-en-US-409778.pdf