CVE-2016-10140: Infoleak
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10140?
CVE-2016-10140 is classified as a medium severity vulnerability due to its potential for information disclosure and authentication bypass.
How do I fix CVE-2016-10140?
To fix CVE-2016-10140, update ZoneMinder to the latest version that addresses the vulnerability.
What platforms are affected by CVE-2016-10140?
CVE-2016-10140 specifically affects ZoneMinder versions 1.29 and 1.30.0.
What kind of attacks are possible with CVE-2016-10140?
CVE-2016-10140 allows remote unauthenticated attackers to browse directories in the web root, potentially exposing sensitive information.
Is there a workaround for CVE-2016-10140?
A potential workaround for CVE-2016-10140 includes restricting access to the ZoneMinder web interface via firewall rules or IP whitelisting.