Vintage,
member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.
References
| Link | Resource |
|---|---|
| https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf | Vendor Advisory |
Configurations
History
08 Nov 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-35 | |
| Summary | (en) Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. |
13 Feb 2024, 00:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:* cpe:2.3:o:axis:axis_os_2022:*:*:*:*:lts:*:*:* cpe:2.3:o:axis:axis_os_2020:*:*:*:*:lts:*:*:* |
|
| CWE | CWE-94 | |
| References | () https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Axis axis Os 2022
Axis Axis axis Os Axis axis Os 2020 |
05 Feb 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-05 06:15
Updated : 2024-11-08 09:15
NVD link : CVE-2023-5800
Mitre link : CVE-2023-5800
CVE.ORG link : CVE-2023-5800
JSON object : View
Products Affected
axis
- axis_os
- axis_os_2020
- axis_os_2022