CVE-2019-7347: Race Condition
A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records (add/delete Monitors, Users, etc.).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.7-r0
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-7347.
What is the severity level of CVE-2019-7347?
The severity level of CVE-2019-7347 is high, with a severity value of 7.5.
Which software versions does CVE-2019-7347 affect?
CVE-2019-7347 affects ZoneMinder versions up to and including 1.32.3.
What is the CWE ID of CVE-2019-7347?
The CWE ID of CVE-2019-7347 is CWE-362 and CWE-367.
Is there a fix available for CVE-2019-7347?
Yes, a fix is available for CVE-2019-7347. It is recommended to update to a version of ZoneMinder that is not affected by this vulnerability.