CVE-2023-25825

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25825
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/ZoneMinder/zoneminder/commit/4637eaf9ea530193e0897ec48899f5638bdd6d81 Patch
https://github.com/ZoneMinder/zoneminder/commit/57bf25d39f12d620693f26068b8441b4f3f0b6c0 Patch
https://github.com/ZoneMinder/zoneminder/commit/e1028c1d7f23cc1e0941b7b37bb6ae5a04364308 Patch
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-68vf-g4qm-jr6v Exploit Patch Vendor Advisory
https://github.com/ZoneMinder/zoneminder/commit/4637eaf9ea530193e0897ec48899f5638bdd6d81 Patch
https://github.com/ZoneMinder/zoneminder/commit/57bf25d39f12d620693f26068b8441b4f3f0b6c0 Patch
https://github.com/ZoneMinder/zoneminder/commit/e1028c1d7f23cc1e0941b7b37bb6ae5a04364308 Patch
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-68vf-g4qm-jr6v Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:50

Type Values Removed Values Added
References () https://github.com/ZoneMinder/zoneminder/commit/4637eaf9ea530193e0897ec48899f5638bdd6d81 - Patch () https://github.com/ZoneMinder/zoneminder/commit/4637eaf9ea530193e0897ec48899f5638bdd6d81 - Patch
References () https://github.com/ZoneMinder/zoneminder/commit/57bf25d39f12d620693f26068b8441b4f3f0b6c0 - Patch () https://github.com/ZoneMinder/zoneminder/commit/57bf25d39f12d620693f26068b8441b4f3f0b6c0 - Patch
References () https://github.com/ZoneMinder/zoneminder/commit/e1028c1d7f23cc1e0941b7b37bb6ae5a04364308 - Patch () https://github.com/ZoneMinder/zoneminder/commit/e1028c1d7f23cc1e0941b7b37bb6ae5a04364308 - Patch
References () https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-68vf-g4qm-jr6v - Exploit, Patch, Vendor Advisory () https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-68vf-g4qm-jr6v - Exploit, Patch, Vendor Advisory
Summary
  • (es) ZoneMinder es una aplicación de software de circuito cerrado de televisión de código abierto y gratuita para Linux que admite cámaras IP, USB y analógicas. Las versiones anteriores a la 1.36.33 son vulnerables a los scripts entre sitios. Las entradas de registro se pueden inyectar en los registros de la base de datos y contienen un campo de referencia malicioso. Esto no tiene escape cuando se ven los registros en la interfaz de usuario web. Este problema se solucionó en la versión 1.36.33.
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 7.7

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33. ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33.
Information

Published : 2023-02-25 01:15

Updated : 2024-11-21 07:50

NVD link : CVE-2023-25825

Mitre link : CVE-2023-25825

CVE.ORG link : CVE-2023-25825

JSON object : View

Products Affected

zoneminder

  • zoneminder
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')