PT-2024-30526 · Unknown+2 · Zoneminder+2

Connortechnology · Published 2024-08-12 · Updated 2024-09-18 · CVE-2024-43358

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.34 ZoneMinder versions prior to 1.37.61

Description ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This issue allows for potential malicious script execution.

Recommendations For versions prior to 1.36.34, update to version 1.36.34 or later. For versions prior to 1.37.61, update to version 1.37.61 or later. As a temporary workaround, consider restricting access to the filter view until a patch is applied. Avoid using the filter[Id] parameter in the affected filter view to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2024-12153

ALT-PU-2024-12804

CVE-2024-43358

GHSA-6RRW-66RF-6G5F

Affected Products

Alt Linux

Debian

Zoneminder

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43358.json · Exploit
• https://github.com/ZoneMinder/zoneminder/commit/062cf568a33fb6a8604ec327b1de8bb2e0d1ff77 · Patch
• https://github.com/ZoneMinder/zoneminder/commit/4602cd0470a3b90b18bcc44b3c86d963872d1ba0 · Patch
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6rrw-66rf-6g5f · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43358 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43358 · Security Note
• https://ubuntu.com/security/CVE-2024-43358 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43358 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-43358 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43358 · Vendor Advisory
• https://twitter.com/PorsilapongoCl/status/1823100955312746706 · Twitter Post
• https://twitter.com/CVEnew/status/1823099929029484800 · Twitter Post
• https://t.me/cvedetector/2901 · Telegram Post
• https://t.me/cvenotify/93256 · Telegram Post