Description
Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.
References
- 9122 vdb-entry
- axis-directory-traversal(17079) vdb-entry
- 11011 vdb-entry
- 20040831 Axis Network Camera and Video Server Security Advisory mailing-list
- 12353 third-party-advisory
- 20040822 [PoC] Nasty bug(s) found in Axis Network Camera/Video Servers mailing-list
- 1011056 vdb-entry