CVE-2019-7337: XSS
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-7337?
CVE-2019-7337 is a vulnerability in ZoneMinder through 1.32.3 that allows for Reflected Cross Site Scripting (XSS).
How does the vulnerability CVE-2019-7337 work?
CVE-2019-7337 works by insecurely displaying the 'limit' parameter value in ZoneMinder's view 'events' (events.php) without proper output filtration, allowing for Reflected Cross Site Scripting (XSS) attacks.
What is the severity of CVE-2019-7337?
The severity of CVE-2019-7337 is medium with a CVSS score of 4.8.
Which software versions are affected by CVE-2019-7337?
ZoneMinder versions up to and including 1.32.3 are affected by CVE-2019-7337.
How can CVE-2019-7337 be fixed?
To fix CVE-2019-7337, it is recommended to update ZoneMinder to a version higher than 1.32.3.