CVE-2022-29806: Path Traversal
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.33+dfsg1-1Fixed in 1.36.35+dfsg1-1Fixed in 1.36.37+dfsg1-1.1 - Upgrade
Upgrade
debian/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.13+dfsg1-1
Event History
Frequently Asked Questions
What is CVE-2022-29806?
CVE-2022-29806 is a vulnerability in ZoneMinder before 1.36.13 that allows remote code execution via an invalid language.
How severe is CVE-2022-29806?
CVE-2022-29806 has a severity rating of 9.8, which is classified as critical.
What software versions are affected by CVE-2022-29806?
ZoneMinder versions up to and excluding 1.36.13 are affected by CVE-2022-29806.
How can CVE-2022-29806 be exploited?
The ability to create a debug log file at an arbitrary pathname contributes to the exploitability of CVE-2022-29806.
How can I fix CVE-2022-29806?
To fix CVE-2022-29806, it is recommended to update ZoneMinder to version 1.36.13 or newer.