CVE-2003-1386 AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file.
MediumCVSS 6.4
EPSS 7.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| axis 2400 video server | = 2.0 | No fix listed |
| axis 2400 video server | = 2.20 | No fix listed |
| axis 2400 video server | = 2.31 | No fix listed |
| axis 2400 video server | = 2.32 | No fix listed |
| axis 2400 video server | = 2.33 | No fix listed |
| axis 2401 video server | = 2.20 | No fix listed |
| axis 2401 video server | = 2.31 | No fix listed |
| axis 2401 video server | = 2.32 | No fix listed |
| axis 2401 video server | = 2.33 | No fix listed |
References
- 20030228 axis2400 webcams mailing-list
- 20030325 Axis Video and Camera Servers - System log access and file access/overwrite via HTTP/CGI mailing-list
- 6980 vdb-entry
- www.websec.org
- axis-messages-unauth-access(11440) vdb-entry