CVE-2023-5800

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5800

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

V

intage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

References
Link Resource
https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf Vendor Advisory
https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:axis:axis_os:*:*:*:*:active:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:axis:axis_os_2020:*:*:*:*:lts:*:*:*
cpe:2.3:o:axis:axis_os_2022:*:*:*:*:lts:*:*:*
History

21 Nov 2024, 08:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 5.4
References () https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf - Vendor Advisory () https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf - Vendor Advisory

08 Nov 2024, 09:15

Type Values Removed Values Added
Summary (en) Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. (en) Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
CWE CWE-35
Information

Published : 2024-02-05 06:15

Updated : 2024-11-21 08:42

NVD link : CVE-2023-5800

Mitre link : CVE-2023-5800

CVE.ORG link : CVE-2023-5800

JSON object : View

Products Affected

axis

CWE
CWE-35

Path Traversal: '.../...//'

CWE-94

Improper Control of Generation of Code ('Code Injection')