CVE-2022-39291: Denial of service through logs in zoneminder
First published: Fri Oct 07 2022(Updated: )
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoneminder Zoneminder | <1.36.27 | |
| Zoneminder Zoneminder | >1.37.0<1.37.24 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html
- https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
- https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c
- https://github.com/ZoneMinder/zoneminder/commit/cb3fc5907da21a5111ae54128a5d0b49ae755e9b
- https://github.com/ZoneMinder/zoneminder/commit/de2866f9574a2bf2690276fad53c91d607825408
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
Frequently Asked Questions
What is CVE-2022-39291?
CVE-2022-39291 is a vulnerability in the ZoneMinder software that allows users with 'View' system permissions to inject new data into the logs stored by ZoneMinder.
How severe is CVE-2022-39291?
CVE-2022-39291 has a severity score of 5.4, which is considered medium.
Which versions of ZoneMinder are affected by CVE-2022-39291?
Versions up to and including 1.36.27 and versions between 1.37.0 and 1.37.24 of ZoneMinder are affected by CVE-2022-39291.
How can I fix CVE-2022-39291?
To fix CVE-2022-39291, users should upgrade their ZoneMinder software to a version higher than 1.37.24 or apply the necessary patches provided by the vendor.
Where can I find more information about CVE-2022-39291?
More information about CVE-2022-39291 can be found at the following references: [PacketStormSecurity](http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html), [GitHub Commit 1](https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4), [GitHub Commit 2](https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/title
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/zoneminder
- canonical/zoneminder zoneminder