CVE-2022-39289: Database log access in ZoneMinder
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39289?
CVE-2022-39289 is a vulnerability in the ZoneMinder CCTV software that allows unauthorized users to access and modify database logs without system privileges.
How severe is CVE-2022-39289?
CVE-2022-39289 has a severity level of 7.5, which is considered critical.
Which versions of ZoneMinder are affected by CVE-2022-39289?
ZoneMinder versions 1.36.27 to 1.37.24 are affected by CVE-2022-39289.
How can I fix the CVE-2022-39289 vulnerability?
To fix the CVE-2022-39289 vulnerability, users are advised to upgrade their ZoneMinder software to a version that is not affected, such as version 1.37.25 or above.
Where can I find more information about CVE-2022-39289?
You can find more information about CVE-2022-39289 on the ZoneMinder GitHub page and the ZoneMinder security advisories page.