PT-2019-18542 · Zoneminder+1 · Zoneminder+1

Loginsoft-Research · Published 2019-02-04 · Updated 2020-02-17 · CVE-2019-7337

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Reflected Cross Site Scripting (XSS) issue exists due to the insecure display of the limit parameter value in the 'events' view (events.php) without proper output filtration. This is caused by the sortHeader() function in functions.php, which returns the value of the limit query string parameter without applying any filtration.

Recommendations For ZoneMinder versions prior to 1.32.4, consider disabling the sortHeader() function in functions.php until a patch is available, or restrict access to the 'events' view (events.php) to minimize the risk of exploitation. Avoid using the limit parameter in the affected view until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-1092

ALT-PU-2020-1246

CVE-2019-7337

Affected Products

Alt Linux

Zoneminder

References · 8

• 🔥 https://github.com/ZoneMinder/zoneminder/issues/2456 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-7337 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-7337 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7337 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7337 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7337 · Vendor Advisory