PT-2019-18542 · Zoneminder+1 · Zoneminder+1

Loginsoft-Research · Publicado 2019-02-04 · Atualizado 2020-02-17 · CVE-2019-7337

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Reflected Cross Site Scripting (XSS) issue exists due to the insecure display of the limit parameter value in the 'events' view (events.php) without proper output filtration. This is caused by the sortHeader() function in functions.php, which returns the value of the limit query string parameter without applying any filtration.

Recommendations For ZoneMinder versions prior to 1.32.4, consider disabling the sortHeader() function in functions.php until a patch is available, or restrict access to the 'events' view (events.php) to minimize the risk of exploitation. Avoid using the limit parameter in the affected view until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2020-1092

ALT-PU-2020-1246

CVE-2019-7337

Produtos afetados

Alt Linux

Zoneminder

Referências · 8

• 🔥 https://github.com/ZoneMinder/zoneminder/issues/2456 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-7337 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-7337 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7337 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7337 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-7337 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7337 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-7337 · Aviso do Fabricante