CVE-2023-21408

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-214099.8Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configurati CVE-2023-21418.8An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execu CVE-2023-214108.8User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.CVE-2023-214118.8User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.CVE-2023-214128.8User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.CVE-2023-214137.2GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on CVE-2023-214146.8NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (CVE-2023-214158.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks CVE-2023-214166.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Servic CVE-2023-214177.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversa CVE-2023-214187.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks CVE-2023-214197.5An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under c