PT-2017-16456 · Zoneminder+1 · Zoneminder+1

Published 2017-02-06 · Updated 2017-06-13 · CVE-2017-5367

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.29 through 1.30

Description Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder, an open-source CCTV server web application. This allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login, view=postlogin, view=console, view=groups, view=events&filter[terms][1][cnj]=and, and view=events&limit=1.

Recommendations For ZoneMinder version 1.29, update to a version that fixes the reflected XSS vulnerabilities. For ZoneMinder version 1.30, update to a version that fixes the reflected XSS vulnerabilities. As a temporary workaround, consider restricting access to the vulnerable parameters, such as view and filter[terms][1][cnj], until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2017-1721

CVE-2017-5367

MGASA-2017-0162

Affected Products

Alt Linux

Zoneminder

References · 35

• 🔥 https://github.com/asaotomo/CVE-2016-10140-Zoneminder-Poc · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Feb/11 · Exploit
• 🔥 http://seclists.org/bugtraq/2017/Feb/6 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10204 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10140 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5367 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5367 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10206 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5367 · Security Note
• https://advisories.mageia.org/MGASA-2017-0162.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10203 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0162 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5595 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10201 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-5367 · Vendor Advisory