CVE-2023-21407

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-214089.8Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration CVE-2023-214099.8Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuratiCVE-2023-21418.8An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execuCVE-2023-214108.8User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.CVE-2023-214118.8User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.CVE-2023-214128.8User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.CVE-2023-214137.2GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on CVE-2023-214146.8NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (CVE-2023-214158.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacksCVE-2023-214166.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-ServicCVE-2023-214177.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversaCVE-2023-214187.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks
CVE-2023-21407: High severity, CVSS 8.8 | Vulnix