PT-2020-16174 · Zoneminder+1 · Zoneminder+1

Niccolo Picca · Published 2020-09-17 · Updated 2022-04-13 · CVE-2020-25729

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.34.21

Description The issue allows for XSS via the connkey parameter to "download.php" or "export.php" API endpoints.

Recommendations For versions prior to 1.34.21, update to version 1.34.21 or later to resolve the issue. As a temporary workaround, consider restricting access to the "download.php" and "export.php" API endpoints to minimize the risk of exploitation. Avoid using the connkey parameter in these endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-2881

ALT-PU-2021-1783

ALT-PU-2022-1687

CVE-2020-25729

Affected Products

Alt Linux

Zoneminder

References · 7

• https://github.com/ZoneMinder/zoneminder/commit/9268db14a79c4ccd444c2bf8d24e62b13207b413 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-25729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25729 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25729 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25729 · Vendor Advisory
• https://forums.zoneminder.com/viewforum.php?f=1 · Vendor Advisory
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.34.21 · Note