SQL Injection in Zoneminder
CVE-2023-26032
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
Vulnerability class: SQL Injection
EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L.
Affected products
- Zoneminder — versions < 1.36.33, >= 1.37.0, < 1.37.33
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-26032?
- CVE-2023-26032 is a high-severity vulnerability in Zoneminder, classified under SQL Injection. CVSS score: 8.9/10. Published 2023-02-25.
- How severe is CVE-2023-26032?
- High severity. CVSS v3 base score is 8.9 out of 10.