Vulnerability · Published Oct 7, 2022 · Assigned by GitHub_M
CVE-2022-39291Denial of service through logs in zoneminder
Medium 5.4
In plain English
A medium-severity improper input validation in zoneminder from ZoneMinder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.1% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | zoneminder | 1.36.31-r0 | ALPINE-CVE-2022-39291 |
| Alpine:v3.21 | zoneminder | 1.36.31-r0 | ALPINE-CVE-2022-39291 |
| Alpine:v3.22 | zoneminder | 1.36.31-r0 | ALPINE-CVE-2022-39291 |
| Alpine:v3.23 | zoneminder | 1.36.31-r0 | ALPINE-CVE-2022-39291 |
| Alpine:v3.24 | zoneminder | 1.36.31-r0 | ALPINE-CVE-2022-39291 |
| Debian:12 | zoneminder | 1.36.31+dfsg1-1 | DEBIAN-CVE-2022-39291 |
| Debian:13 | zoneminder | 1.36.31+dfsg1-1 | DEBIAN-CVE-2022-39291 |
| Debian:14 | zoneminder | 1.36.31+dfsg1-1 | DEBIAN-CVE-2022-39291 |
| Ubuntu:24.04:LTS | zoneminder | no fix listed | UBUNTU-CVE-2022-39291 |
| Ubuntu:25.10 | zoneminder | no fix listed | UBUNTU-CVE-2022-39291 |
| Ubuntu:26.04:LTS | zoneminder | no fix listed | UBUNTU-CVE-2022-39291 |
| Ubuntu:26.10 | zoneminder | no fix listed | UBUNTU-CVE-2022-39291 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZoneMinder | zoneminder | < 1.36.27>= 1.37.0, <1.37.24 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
- https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
- https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c
- https://github.com/ZoneMinder/zoneminder/commit/cb3fc5907da21a5111ae54128a5d0b49ae755e9b
- https://github.com/ZoneMinder/zoneminder/commit/de2866f9574a2bf2690276fad53c91d607825408
- http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html