PT-2024-30527 · Unknown+2 · Zoneminder+2

Connortechnology · Published 2024-08-12 · Updated 2024-09-18 · CVE-2024-43359

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.34 ZoneMinder versions prior to 1.37.61

Description ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters.

Recommendations For versions prior to 1.36.34, update to version 1.36.34 or later. For versions prior to 1.37.61, update to version 1.37.61 or later. As a temporary workaround, consider restricting access to the montagereview feature until a patch is applied. Avoid using the displayinterval, speed, and scale parameters in the montagereview feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2024-12153

ALT-PU-2024-12804

CVE-2024-43359

GHSA-PJJM-3QXP-6HJ8

Affected Products

Alt Linux

Debian

Zoneminder

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43359.json · Exploit
• https://github.com/ZoneMinder/zoneminder/commit/6cc64dddff6144a98680f65ecf8dc249028431af · Patch
• https://github.com/ZoneMinder/zoneminder/commit/b51c5df0cb869ca48fccfc6e6fd7c19bf717ecd2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-43359 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-43359 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43359 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43359 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43359 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43359 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-43359 · Vendor Advisory
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8 · Note
• https://t.me/cvedetector/2902 · Telegram Post
• https://t.me/cvenotify/93257 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823107204574073179 · Twitter Post
• https://twitter.com/CVEnew/status/1823105873335488712 · Twitter Post