What is CVE-2021-31988?

CVE-2021-31988 is a high-severity vulnerability in Axis Axis_os, classified under CWE-1286. CVSS score: 8.8/10. Published 2021-10-05.

How severe is CVE-2021-31988?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Axis Axis_os

CVE-2021-31988

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary SMTP headers in the generated test email.

EPSS: 0.009 (55.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Axis Axis_os
Axis Axis_os_2016
Axis Axis_os_2018
Axis Axis_os_2020
Axis Communications Ab Os — versions AXIS OS 5.51 or later

Weakness classification (CWE)

CWE-1286
CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

product-security@axis.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-31988?: CVE-2021-31988 is a high-severity vulnerability in Axis Axis_os, classified under CWE-1286. CVSS score: 8.8/10. Published 2021-10-05.
How severe is CVE-2021-31988?: High severity. CVSS v3 base score is 8.8 out of 10.