PT-2019-18557 · Zoneminder+1 · Zoneminder+1

Published 2019-02-04 · Updated 2020-02-17 · CVE-2019-7352

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Self-Stored Cross Site Scripting (XSS) issue exists due to the lack of input validation in the 'New State' field, allowing an attacker to execute HTML or JavaScript code.

Recommendations For versions prior to 1.32.4, update to version 1.32.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the state.php view to minimize the risk of exploitation. Avoid using the newState field in the affected view until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-1092

ALT-PU-2020-1246

CVE-2019-7352

Affected Products

Alt Linux

Zoneminder

References · 8

• 🔥 https://github.com/ZoneMinder/zoneminder/issues/2475 · Exploit
• https://osv.dev/vulnerability/CVE-2019-7352 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7352 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-7352 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7352 · Security Note
• https://ubuntu.com/security/CVE-2019-7352 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7352 · Vendor Advisory