Axis M10 Series Network Cameras Cross Site Scripting Vulnerability

Bugtraq ID:	50968
Class:	Input Validation Error
CVE:	CVE-2011-5261
Remote:	Yes
Local:	No
Published:	Dec 07 2011 12:00AM
Updated:	Feb 14 2013 12:21PM
Credit:	Matt Metzger
Vulnerable:	Axis M1054 firmware 5.21 Axis M10 Series Network Camera 0
Not Vulnerable:

Axis M10 Series Network Cameras Cross Site Scripting Vulnerability

Axis M10 Series Network Cameras are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Axis M1054 firmware 5.21 is vulnerable; other version may also be affected.

Axis M10 Series Network Cameras Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

The following example URL is available:

• /data/vulnerabilities/exploits/50968.txt

Axis M10 Series Network Cameras Cross Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Axis M10 Series Network Cameras Cross Site Scripting Vulnerability

References:

• Axis M10 Series Network Camera Homepage (Axis)
  
• XSS Vulnerability: Axis M10 Series Network Camera showReport.shtml/serverreport. (Matt Metzger)