CVE-2007-5212 Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via (1) parameters asso...
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via (1) parameters associated with saved settings, as demonstrated by the conf_SMTP_MailServer1 parameter to ServerManager.srv; or (2) the subpage parameter to wizard/first/wizard_main_first.shtml. NOTE: an attacker can leverage a CSRF vulnerability to modify saved settings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| axis 2100 network camera | = 2.02 | No fix listed |
| axis 2100 network camera firmware | <= 2.42 | No fix listed |
References
- 38795 vdb-entry
- 38796 vdb-entry
- 3188 third-party-advisory
- www.procheckup.com exploit
- 20070928 Owning Big Brother: How to Crack into Axis IP cameras mailing-list
- 25837 vdb-entry