CVE-2022-39291: Denial of service through logs in zoneminder
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39291?
CVE-2022-39291 is a vulnerability in the ZoneMinder software that allows users with 'View' system permissions to inject new data into the logs stored by ZoneMinder.
How severe is CVE-2022-39291?
CVE-2022-39291 has a severity score of 5.4, which is considered medium.
Which versions of ZoneMinder are affected by CVE-2022-39291?
Versions up to and including 1.36.27 and versions between 1.37.0 and 1.37.24 of ZoneMinder are affected by CVE-2022-39291.
How can I fix CVE-2022-39291?
To fix CVE-2022-39291, users should upgrade their ZoneMinder software to a version higher than 1.37.24 or apply the necessary patches provided by the vendor.
Where can I find more information about CVE-2022-39291?
More information about CVE-2022-39291 can be found at the following references: [PacketStormSecurity](http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html), [GitHub Commit 1](https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4), [GitHub Commit 2](https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c).