CVE-2008-1381: Code Injection
Published May 1, 2008
·Updated
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
Affected Software
36 affected components
ZoneMinder Zoneminder=0.0.1
ZoneMinder Zoneminder=0.9.7
ZoneMinder Zoneminder=0.9.8
ZoneMinder Zoneminder=0.9.9
ZoneMinder Zoneminder=0.9.10
ZoneMinder Zoneminder=0.9.11
ZoneMinder Zoneminder=0.9.12
ZoneMinder Zoneminder=0.9.13
ZoneMinder Zoneminder=0.9.14
ZoneMinder Zoneminder=0.9.15
ZoneMinder Zoneminder=0.9.16
ZoneMinder Zoneminder=1.17.0
ZoneMinder Zoneminder=1.17.1
ZoneMinder Zoneminder=1.17.2
ZoneMinder Zoneminder=1.18.0
ZoneMinder Zoneminder=1.18.1
ZoneMinder Zoneminder=1.19.0
ZoneMinder Zoneminder=1.19.1
ZoneMinder Zoneminder=1.19.2
ZoneMinder Zoneminder=1.19.3
ZoneMinder Zoneminder=1.19.4
ZoneMinder Zoneminder=1.19.5
ZoneMinder Zoneminder=1.20.0
ZoneMinder Zoneminder=1.20.1
ZoneMinder Zoneminder=1.21.0
ZoneMinder Zoneminder=1.21.1
ZoneMinder Zoneminder=1.21.2
ZoneMinder Zoneminder=1.21.3
ZoneMinder Zoneminder=1.21.4
ZoneMinder Zoneminder=1.22.0
ZoneMinder Zoneminder=1.22.1
ZoneMinder Zoneminder=1.22.2
ZoneMinder Zoneminder=1.22.3
ZoneMinder Zoneminder=1.23.0
ZoneMinder Zoneminder=1.23.1
ZoneMinder Zoneminder=1.23.2
Event History
May 1, 2008
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1381?
CVE-2008-1381 has been rated as a medium severity vulnerability due to its potential for command execution by authenticated users.
2
How do I fix CVE-2008-1381?
To fix CVE-2008-1381, upgrade ZoneMinder to version 1.23.3 or later.
3
What type of attack is associated with CVE-2008-1381?
CVE-2008-1381 allows remote attackers to execute arbitrary commands via crafted URLs using shell metacharacters.
4
Can unauthenticated users exploit CVE-2008-1381?
In some installations, CVE-2008-1381 may allow unauthenticated users to exploit the vulnerability.
5
What versions of ZoneMinder are affected by CVE-2008-1381?
CVE-2008-1381 affects multiple versions of ZoneMinder prior to 1.23.3, including versions 0.0.1 through 1.22.3.