CVE-2019-7351: Medium severity ZoneMinder Zoneminder vulnerability
Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.7-r0
Event History
Frequently Asked Questions
What is the vulnerability ID for this Log Injection vulnerability?
The vulnerability ID for this Log Injection vulnerability is CVE-2019-7351.
What is the severity of CVE-2019-7351?
The severity of CVE-2019-7351 is medium with a CVSS score of 6.5.
How does Log Injection occur in ZoneMinder?
Log Injection occurs in ZoneMinder when an attacker tricks a victim into visiting a specially crafted link that injects a customized log message.
Which version of ZoneMinder is affected by CVE-2019-7351?
ZoneMinder versions up to and including 1.32.3 are affected by CVE-2019-7351.
Is there a fix available for CVE-2019-7351?
Yes, upgrading to a version later than 1.32.3 of ZoneMinder resolves the Log Injection vulnerability.