CVE-2024-43360: ZoneMinder Time-based SQL Injection
First published: Mon Aug 12 2024(Updated: )
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ZoneMinder | <1.36.34 | |
| ZoneMinder | >=1.37.00<1.37.61 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj
- https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a
- https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6
- https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397
- https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5
Frequently Asked Questions
What is the severity of CVE-2024-43360?
CVE-2024-43360 is classified as a significant security risk due to its potential for SQL injection attacks.
How do I fix CVE-2024-43360?
To fix CVE-2024-43360, update ZoneMinder to version 1.36.34 or later, or to version 1.37.61 or later.
Which versions of ZoneMinder are affected by CVE-2024-43360?
CVE-2024-43360 affects ZoneMinder versions prior to 1.36.34 and between versions 1.37.00 and 1.37.61.
What type of vulnerability is CVE-2024-43360?
CVE-2024-43360 is a time-based SQL Injection vulnerability that could allow attackers to manipulate database queries.
Is it safe to continue using an affected version of ZoneMinder for now?
It is not safe to continue using an affected version of ZoneMinder as it exposes your system to SQL injection risks.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/zoneminder
- canonical/zoneminder
- version/zoneminder/1.37.00