Vulnerability in Zoneminder
CVE-2013-0232
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) co…
EPSS: 0.782 (99.0th percentile) — read the EPSS interpretation.
Affected products
- Zoneminder — versions 1.24.0, 1.24.1, 1.24.2
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (Exploit, x_refsource_MISC)
- [oss-security] 20130128 Re: CVE Request: zoneminder: arbitrary command execution vulnerability (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_MISC)
- DSA-2640 (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_MISC)
- 24310 (exploit, x_refsource_EXPLOIT-DB)
- 89529 (x_refsource_OSVDB, vdb-entry)
Frequently asked questions
- What is CVE-2013-0232?
- CVE-2013-0232 is a vulnerability in Zoneminder. Published 2013-03-20.
- Is CVE-2013-0232 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.