PT-2022-24872 · Unknown+2 · Zoneminder+2

Published 2022-10-07 · Updated 2023-11-30 · CVE-2022-39289

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder (affected versions not specified)

Description The issue concerns the ZoneMinder API, which exposes database log contents to users without privileges. It also allows for the insertion, modification, and deletion of logs without system privileges. Users are advised to upgrade as soon as possible.

Recommendations For all affected versions, users are advised to upgrade as soon as possible. As a temporary workaround for users unable to upgrade, consider disabling database logging to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-287

CWE-862

CWE-200

Related Identifiers

ALT-PU-2022-2858

ALT-PU-2022-2978

ALT-PU-2023-7284

CVE-2022-39289

GHSA-MPCX-3GVH-9488

Affected Products

Alt Linux

Debian

Zoneminder

References · 11

• 🔥 https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39289.json · Exploit
• https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39289 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39289 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-39289 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39289 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39289 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39289 · Vendor Advisory
• https://t.me/cibsecurity/51037 · Telegram Post