CVE-2024-43360: ZoneMinder Time-based SQL Injection
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.35+dfsg1-1 - Upgrade
Upgrade
debian/zoneminderto a version that resolves this vulnerability.Fixed in 1.36.35+dfsg1-1Fixed in 1.36.37+dfsg1-1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.36.34 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.37.61
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43360?
CVE-2024-43360 is classified as a significant security risk due to its potential for SQL injection attacks.
How do I fix CVE-2024-43360?
To fix CVE-2024-43360, update ZoneMinder to version 1.36.34 or later, or to version 1.37.61 or later.
Which versions of ZoneMinder are affected by CVE-2024-43360?
CVE-2024-43360 affects ZoneMinder versions prior to 1.36.34 and between versions 1.37.00 and 1.37.61.
What type of vulnerability is CVE-2024-43360?
CVE-2024-43360 is a time-based SQL Injection vulnerability that could allow attackers to manipulate database queries.
Is it safe to continue using an affected version of ZoneMinder for now?
It is not safe to continue using an affected version of ZoneMinder as it exposes your system to SQL injection risks.