PT-2022-20303 · Unknown+2 · Zoneminder+2

Published 2022-09-07 · Updated 2025-04-30 · CVE-2022-30769

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.13

Description The issue allows an attacker to poison a session cookie, which can then be used by the next logged-in user. This can lead to unauthorized access to user accounts.

Recommendations For ZoneMinder versions prior to 1.36.13, update to version 1.36.13 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

ALT-PU-2022-2575

ALT-PU-2022-2771

ALT-PU-2023-7284

CVE-2022-30769

Affected Products

Alt Linux

Debian

Zoneminder

References · 12

• 🔥 https://medium.com/@dk50u1/session-fixation-in-zoneminder-up-to-v1-36-12-3c850b1fbbf3 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30769 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-30769 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30769 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-30769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30769 · Security Note
• https://ubuntu.com/security/CVE-2022-30769 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-30769 · Vendor Advisory
• https://github.com/ZoneMinder/zoneminder/releases · Note
• https://t.me/cvenotify/37826 · Telegram Post
• https://medium.com/%40dk50u1/session-fixation-in-zoneminder-up-to-v1-36-12-3c850b1fbbf3 · Note
• https://t.me/cvenotify/120361 · Telegram Post