CVE-2019-7334: XSS

Q: What is CVE-2019-7334?

CVE-2019-7334 is a vulnerability that allows an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in ZoneMinder through version 1.32.3.

Q: How severe is CVE-2019-7334?

CVE-2019-7334 has a severity rating of 6.1, which is considered medium.

Q: How does CVE-2019-7334 work?

CVE-2019-7334 exploits a reflected cross-site scripting (XSS) vulnerability in ZoneMinder, specifically in the 'Exportfile' parameter of the view export feature (export.php).

Q: What software versions are affected by CVE-2019-7334?

ZoneMinder versions up to and including 1.32.3 are affected by CVE-2019-7334.

Q: Is there a fix for CVE-2019-7334?

Yes, updating ZoneMinder to a version beyond 1.32.3 will fix the vulnerability.

Published Feb 4, 2019

Updated

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export (export.php) because proper filtration is omitted.

Affected Software

1 affected component

ZoneMinder Zoneminder<=1.32.3

Event History

Feb 4, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is CVE-2019-7334?

CVE-2019-7334 is a vulnerability that allows an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in ZoneMinder through version 1.32.3.

How severe is CVE-2019-7334?

CVE-2019-7334 has a severity rating of 6.1, which is considered medium.

How does CVE-2019-7334 work?

CVE-2019-7334 exploits a reflected cross-site scripting (XSS) vulnerability in ZoneMinder, specifically in the 'Exportfile' parameter of the view export feature (export.php).

What software versions are affected by CVE-2019-7334?

ZoneMinder versions up to and including 1.32.3 are affected by CVE-2019-7334.

Is there a fix for CVE-2019-7334?