Improper input validation in Zoneminder
CVE-2022-39291
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.052 (91.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Zoneminder — versions < 1.36.27, >= 1.37.0, <1.37.24
Weakness classification (CWE)
References
- security-advisories@github.com (Exploit, Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com
Frequently asked questions
- What is CVE-2022-39291?
- CVE-2022-39291 is a medium-severity vulnerability in Zoneminder, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2022-10-07.
- How severe is CVE-2022-39291?
- Medium severity. CVSS v3 base score is 5.4 out of 10.