CVE-2017-7203: XSS

Published Mar 21, 2017

Updated

A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the "ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Affected Software

1 affected component

ZoneMinder Zoneminder=1.30.2

Remediation

Patch Available

https://github.com/ZoneMinder/ZoneMinder/issues/1797

Event History

Mar 21, 2017

CVE Published

via MITRE·06:21 AM

Data Sourced

via MITRE·06:21 AM

Description

Data Sourced

via NVD·06:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-7203?

CVE-2017-7203 is classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2017-7203?

To resolve CVE-2017-7203, upgrade to ZoneMinder version 1.30.2 or later, which includes patches for this vulnerability.

What type of vulnerability is CVE-2017-7203?

CVE-2017-7203 is a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary scripts in the context of a user's browser.

What does CVE-2017-7203 affect?

CVE-2017-7203 affects ZoneMinder versions prior to 1.30.2, specifically impacting the handling of user-supplied data.

Can CVE-2017-7203 be exploited remotely?

Yes, CVE-2017-7203 can be exploited remotely by an attacker through a malicious payload in web requests to the affected ZoneMinder installation.