CVE-2019-7341: XSS
Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.7-r0
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2019-7341.
What is the severity rating of CVE-2019-7341?
CVE-2019-7341 has a severity rating of medium.
What software version is affected by CVE-2019-7341?
CVE-2019-7341 affects ZoneMinder versions up to 1.32.3.
How does the vulnerability in CVE-2019-7341 work?
CVE-2019-7341 is a reflected cross-site scripting (XSS) vulnerability that allows an attacker to execute HTML or JavaScript code by manipulating the 'newMonitor[LinkedMonitors]' parameter in the view monitor page (monitor.php) of ZoneMinder.
Is there a fix available for CVE-2019-7341?
Yes, upgrading ZoneMinder to a version beyond 1.32.3 will fix the vulnerability.