PT-2019-18552 · Zoneminder+1 · Zoneminder+1

Loginsoft-Research · Publicado 2019-02-04 · Atualizado 2020-08-24 · CVE-2019-7347

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Time-of-check Time-of-use (TOCTOU) Race Condition issue exists, allowing a nonexistent user to access and modify records, such as adding or deleting Monitors and Users, because a session remains active for an authenticated user even after their deletion from the users table.

Recommendations For ZoneMinder versions prior to 1.32.4, update to version 1.32.4 or later to resolve the issue.

Exploit

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

ALT-PU-2020-1092

ALT-PU-2020-1246

CVE-2019-7347

Produtos afetados

Alt Linux

Zoneminder

Referências · 8

• 🔥 https://github.com/ZoneMinder/zoneminder/issues/2476 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7347 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-7347 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7347 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7347 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-7347 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-7347 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-7347 · Aviso do Fabricante