Log in Start free

Vulnerability · Published Oct 7, 2022 · Assigned by GitHub_M

CVE-2022-39285Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder

High 7.6

In plain English

A high-severity cross-site scripting in zoneminder from ZoneMinder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)5.1%top 7.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20zoneminder1.36.31-r0ALPINE-CVE-2022-39285
Alpine:v3.21zoneminder1.36.31-r0ALPINE-CVE-2022-39285
Alpine:v3.22zoneminder1.36.31-r0ALPINE-CVE-2022-39285
Alpine:v3.23zoneminder1.36.31-r0ALPINE-CVE-2022-39285
Alpine:v3.24zoneminder1.36.31-r0ALPINE-CVE-2022-39285
Debian:12zoneminder1.36.31+dfsg1-1DEBIAN-CVE-2022-39285
Debian:13zoneminder1.36.31+dfsg1-1DEBIAN-CVE-2022-39285
Debian:14zoneminder1.36.31+dfsg1-1DEBIAN-CVE-2022-39285
Ubuntu:24.04:LTSzoneminderno fix listedUBUNTU-CVE-2022-39285
Ubuntu:25.10zoneminderno fix listedUBUNTU-CVE-2022-39285
Ubuntu:26.04:LTSzoneminderno fix listedUBUNTU-CVE-2022-39285
Ubuntu:26.10zoneminderno fix listedUBUNTU-CVE-2022-39285

Affected products (as reported)

VendorProductVersions
ZoneMinder zoneminder < 1.36.27>= 1.37.0, < 1.37.24

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

References