CVE-2023-5800: Insufficient input validation in VAPIX API create_overlay.cgi
First published: Mon Feb 05 2024(Updated: )
Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Credit: product-security@axis.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Axis Axis Os | <11.8.61 | |
| Axis Axis Os 2020 | <9.80.55 | |
| Axis Axis Os 2022 | <10.12.220 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/event
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/tags
- agent/epss
- vendor/axis
- canonical/axis axis os
- canonical/axis axis os 2020
- canonical/axis axis os 2022