Details of VAR-200710-0194

ID

VAR-200710-0194

CVE

CVE-2007-5214

TITLE

AXIS 2100 Network Camera Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2007-002722

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to the default URI associated with a directory, as demonstrated by (a) the root directory and (b) the view/ directory; (2) parameters associated with saved settings, as demonstrated by (c) the conf_Network_HostName parameter on the Network page and (d) the conf_Layout_OwnTitle parameter to ServerManager.srv; and (3) the query string to ServerManager.srv, which is displayed on the logs page. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings. (1) The default associated with the directory URI Against PATH_INFO (2) Parameters related to saved settings (3) ServerManager.srv Query string for. 2100 Network Camera is prone to a cross-site scripting vulnerability. The query string of srv will be displayed on the page

Trust: 1.98

sources: NVD: CVE-2007-5214 // JVNDB: JVNDB-2007-002722 // BID: 81576 // VULHUB: VHN-28576

AFFECTED PRODUCTS

vendor:	axis	model:	2100 network camera	scope:	lte	version:	2.02	Trust: 1.0
vendor:	axis	model:	2100 network camera	scope:	lte	version:	2.02 firmware 2.43	Trust: 0.8
vendor:	axis	model:	2100 network camera	scope:	eq	version:	2.02	Trust: 0.6
vendor:	axis	model:	communications network camera	scope:	eq	version:	21002.022.43	Trust: 0.3

sources: BID: 81576 // JVNDB: JVNDB-2007-002722 // CNNVD: CNNVD-200710-065 // NVD: CVE-2007-5214

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2007-5214
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2007-5214
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200710-065
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-28576
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2007-5214
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-28576
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-28576 // JVNDB: JVNDB-2007-002722 // CNNVD: CNNVD-200710-065 // NVD: CVE-2007-5214

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-28576 // JVNDB: JVNDB-2007-002722 // NVD: CVE-2007-5214

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200710-065

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-200710-065

CONFIGURATIONS

sources: JVNDB: JVNDB-2007-002722

PATCH

title:

Top Page

url:

http://www.axis.com/techsup/software/acc/index.htm

Trust: 0.8

sources: JVNDB: JVNDB-2007-002722

EXTERNAL IDS

db:	NVD	id:	CVE-2007-5214	Trust: 2.8
db:	BID	id:	25837	Trust: 2.0
db:	SREASON	id:	3188	Trust: 2.0
db:	OSVDB	id:	39493	Trust: 1.7
db:	OSVDB	id:	39495	Trust: 1.7
db:	OSVDB	id:	39492	Trust: 1.7
db:	OSVDB	id:	39494	Trust: 1.7
db:	XF	id:	36840	Trust: 0.9
db:	XF	id:	36841	Trust: 0.9
db:	XF	id:	36842	Trust: 0.9
db:	JVNDB	id:	JVNDB-2007-002722	Trust: 0.8
db:	XF	id:	2100	Trust: 0.6
db:	BUGTRAQ	id:	20070928 OWNING BIG BROTHER: HOW TO CRACK INTO AXIS IP CAMERAS	Trust: 0.6
db:	CNNVD	id:	CNNVD-200710-065	Trust: 0.6
db:	BID	id:	81576	Trust: 0.4
db:	VULHUB	id:	VHN-28576	Trust: 0.1

sources: VULHUB: VHN-28576 // BID: 81576 // JVNDB: JVNDB-2007-002722 // CNNVD: CNNVD-200710-065 // NVD: CVE-2007-5214

REFERENCES

url:	http://www.securityfocus.com/bid/25837	Trust: 2.0
url:	http://www.procheckup.com/vulnerability_axis_2100_research.pdf	Trust: 2.0
url:	http://securityreason.com/securityalert/3188	Trust: 2.0
url:	http://osvdb.org/39492	Trust: 1.7
url:	http://osvdb.org/39493	Trust: 1.7
url:	http://osvdb.org/39494	Trust: 1.7
url:	http://osvdb.org/39495	Trust: 1.7
url:	http://www.securityfocus.com/archive/1/480995/100/0/threaded	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/36842	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/36840	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/36841	Trust: 1.1
url:	http://xforce.iss.net/xforce/xfdb/36842	Trust: 0.9
url:	http://xforce.iss.net/xforce/xfdb/36841	Trust: 0.9
url:	http://xforce.iss.net/xforce/xfdb/36840	Trust: 0.9
url:	http://www.securityfocus.com/archive/1/archive/1/480995/100/0/threaded	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5214	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5214	Trust: 0.8

sources: VULHUB: VHN-28576 // BID: 81576 // JVNDB: JVNDB-2007-002722 // CNNVD: CNNVD-200710-065 // NVD: CVE-2007-5214

CREDITS

Unknown

Trust: 0.3

sources: BID: 81576

SOURCES

db:	VULHUB	id:	VHN-28576
db:	BID	id:	81576
db:	JVNDB	id:	JVNDB-2007-002722
db:	CNNVD	id:	CNNVD-200710-065
db:	NVD	id:	CVE-2007-5214

LAST UPDATE DATE

2024-11-23T22:09:45.937000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-28576	date:	2018-10-15T00:00:00
db:	BID	id:	81576	date:	2007-10-04T00:00:00
db:	JVNDB	id:	JVNDB-2007-002722	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200710-065	date:	2007-10-08T00:00:00
db:	NVD	id:	CVE-2007-5214	date:	2024-11-21T00:37:23.527

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-28576	date:	2007-10-04T00:00:00
db:	BID	id:	81576	date:	2007-10-04T00:00:00
db:	JVNDB	id:	JVNDB-2007-002722	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200710-065	date:	2007-10-04T00:00:00
db:	NVD	id:	CVE-2007-5214	date:	2007-10-04T23:17:00