CVE-2023-5800CWE-35

Insufficient input validation in VAPIX API create_overlay.cgi

Medium · published February 5, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Vintage,

member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi

did not have a sufficient input validation allowing for a possible remote code

execution. This flaw can only be exploited after authenticating with an

operator- or administrator-privileged service account. Axis has released patched AXIS OS

versions for the highlighted flaw. Please refer to the Axis security advisory

for more information and solution.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2024-02-05T05:20Z
EPSS history
Timeline
  • 05 FEB 05:20Z
    Insufficient input validation in VAPIX API create_overlay.cgi
    cvelistv5