Log in Start free

Vulnerability · Published Oct 7, 2022 · Assigned by GitHub_M

CVE-2022-39289Database log access in ZoneMinder

Critical 9.1

In plain English

A critical-severity information exposure in zoneminder from ZoneMinder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.0%top 38.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20zoneminder1.36.31-r0ALPINE-CVE-2022-39289
Alpine:v3.21zoneminder1.36.31-r0ALPINE-CVE-2022-39289
Alpine:v3.22zoneminder1.36.31-r0ALPINE-CVE-2022-39289
Alpine:v3.23zoneminder1.36.31-r0ALPINE-CVE-2022-39289
Alpine:v3.24zoneminder1.36.31-r0ALPINE-CVE-2022-39289
Debian:12zoneminder1.36.31+dfsg1-1DEBIAN-CVE-2022-39289
Debian:13zoneminder1.36.31+dfsg1-1DEBIAN-CVE-2022-39289
Debian:14zoneminder1.36.31+dfsg1-1DEBIAN-CVE-2022-39289
Ubuntu:24.04:LTSzoneminderno fix listedUBUNTU-CVE-2022-39289
Ubuntu:25.10zoneminderno fix listedUBUNTU-CVE-2022-39289
Ubuntu:26.04:LTSzoneminderno fix listedUBUNTU-CVE-2022-39289
Ubuntu:26.10zoneminderno fix listedUBUNTU-CVE-2022-39289

Affected products (as reported)

VendorProductVersions
ZoneMinder zoneminder < 1.36.27>= 1.37.0, < 1.37.24

Weakness: CWE-200, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References