RCE in Zoneminder

CVE-2008-1381

ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.025 (83.2th percentile) — read the EPSS interpretation.

Affected products

  • Zoneminder — versions 0.0.1, 0.9.7, 0.9.8
  • N/a — versions n/a

Weakness classification (CWE)

References