PT-2023-20438 · Unknown+2 · Zoneminder+2
CVE-2023-26036
·
Publicado
2023-02-25
·
Atualizado
2023-11-30
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ZoneMinder versions prior to 1.36.33
ZoneMinder versions prior to 1.37.33
Description
The issue is a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling
$view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however detaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../".Recommendations
For versions prior to 1.36.33, update to version 1.36.33 or later.
For versions prior to 1.37.33, update to version 1.37.33 or later.
As a temporary workaround, consider restricting access to the
/web/index.php endpoint until a patch is available.
Avoid using the $view variable in the affected API endpoint until the issue is resolved.Exploit
Correção
Untrusted Search Path
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Debian
Zoneminder