CVE-2019-7336: XSS
First published: Mon Feb 04 2019(Updated: )
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoneminder Zoneminder | <=1.32.3 | |
| <=1.32.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-7336?
CVE-2019-7336 is a vulnerability in ZoneMinder through version 1.32.3 that allows for Self-Stored Cross-Site Scripting (XSS) attacks.
How does CVE-2019-7336 impact ZoneMinder?
CVE-2019-7336 allows attackers to inject malicious scripts into the view _monitor_filters.php page, potentially enabling them to steal information or perform actions on behalf of the user.
What is the severity of CVE-2019-7336?
CVE-2019-7336 has a severity rating of 6.1, which is considered medium.
How can I fix CVE-2019-7336?
To fix CVE-2019-7336, update ZoneMinder to version 1.32.3 or later.
Where can I find more information about CVE-2019-7336?
You can find more information about CVE-2019-7336 on the ZoneMinder GitHub page: https://github.com/ZoneMinder/zoneminder/issues/2457.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/zoneminder
- canonical/zoneminder zoneminder
- version/zoneminder zoneminder/1.32.3