CVE-2019-7337: XSS
First published: Mon Feb 04 2019(Updated: )
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoneminder Zoneminder | <=1.32.3 | |
| <=1.32.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-7337?
CVE-2019-7337 is a vulnerability in ZoneMinder through 1.32.3 that allows for Reflected Cross Site Scripting (XSS).
How does the vulnerability CVE-2019-7337 work?
CVE-2019-7337 works by insecurely displaying the 'limit' parameter value in ZoneMinder's view 'events' (events.php) without proper output filtration, allowing for Reflected Cross Site Scripting (XSS) attacks.
What is the severity of CVE-2019-7337?
The severity of CVE-2019-7337 is medium with a CVSS score of 4.8.
Which software versions are affected by CVE-2019-7337?
ZoneMinder versions up to and including 1.32.3 are affected by CVE-2019-7337.
How can CVE-2019-7337 be fixed?
To fix CVE-2019-7337, it is recommended to update ZoneMinder to a version higher than 1.32.3.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/zoneminder
- canonical/zoneminder zoneminder
- version/zoneminder zoneminder/1.32.3