CVE-2016-10205: High severity ZoneMinder Zoneminder vulnerability
Published Mar 3, 2017
·Updated
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
Affected Software
1 affected component
ZoneMinder Zoneminder<=1.30.0
Event History
Mar 3, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-10205?
CVE-2016-10205 is classified as a medium severity vulnerability due to its potential to allow session hijacking.
2
How do I fix CVE-2016-10205?
To fix CVE-2016-10205, upgrade to ZoneMinder version 1.30.1 or later where the vulnerability is patched.
3
What type of attacks are possible with CVE-2016-10205?
CVE-2016-10205 allows remote attackers to perform session fixation attacks, potentially hijacking user sessions.
4
Which versions of ZoneMinder are affected by CVE-2016-10205?
CVE-2016-10205 affects all versions of ZoneMinder up to and including 1.30.0.
5
What is the nature of the exploitation in CVE-2016-10205?
The exploitation of CVE-2016-10205 occurs via the manipulation of the ZMSESSID cookie to hijack active web sessions.