CVE-2019-7328: XSS

Q: What is CVE-2019-7328?

CVE-2019-7328 is a vulnerability in ZoneMinder through version 1.32.3 that allows an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter in the view frame.

Q: How severe is CVE-2019-7328?

CVE-2019-7328 has a severity rating of 6.1 (medium).

Q: How does CVE-2019-7328 work?

CVE-2019-7328 exploits a reflected cross-site scripting (XSS) vulnerability in ZoneMinder, specifically in the 'scale' parameter value in the view frame (frame.php).

Q: Which version of ZoneMinder is affected by CVE-2019-7328?

ZoneMinder version 1.32.3 is affected by CVE-2019-7328.

Q: Is there a fix for CVE-2019-7328?

Yes, upgrading to a version of ZoneMinder beyond 1.32.3 will fix CVE-2019-7328.

Published Feb 4, 2019

Updated

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) via /js/frame.js.php because proper filtration is omitted.

Affected Software

1 affected component

ZoneMinder Zoneminder<=1.32.3

Event History

Feb 4, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is CVE-2019-7328?

CVE-2019-7328 is a vulnerability in ZoneMinder through version 1.32.3 that allows an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter in the view frame.

How severe is CVE-2019-7328?

CVE-2019-7328 has a severity rating of 6.1 (medium).

How does CVE-2019-7328 work?

CVE-2019-7328 exploits a reflected cross-site scripting (XSS) vulnerability in ZoneMinder, specifically in the 'scale' parameter value in the view frame (frame.php).

Which version of ZoneMinder is affected by CVE-2019-7328?

ZoneMinder version 1.32.3 is affected by CVE-2019-7328.

Is there a fix for CVE-2019-7328?