CVE-2019-7336: XSS
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view monitorfilters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-7336?
CVE-2019-7336 is a vulnerability in ZoneMinder through version 1.32.3 that allows for Self-Stored Cross-Site Scripting (XSS) attacks.
How does CVE-2019-7336 impact ZoneMinder?
CVE-2019-7336 allows attackers to inject malicious scripts into the view _monitor_filters.php page, potentially enabling them to steal information or perform actions on behalf of the user.
What is the severity of CVE-2019-7336?
CVE-2019-7336 has a severity rating of 6.1, which is considered medium.
How can I fix CVE-2019-7336?
To fix CVE-2019-7336, update ZoneMinder to version 1.32.3 or later.
Where can I find more information about CVE-2019-7336?
You can find more information about CVE-2019-7336 on the ZoneMinder GitHub page: https://github.com/ZoneMinder/zoneminder/issues/2457.