GHSA-6rrw-66rf-6g5f: XSS vulnerability in filter view

Q: Which ZoneMinder versions contain the fix?

The vulnerability is fixed in ZoneMinder versions 1.36.34 and 1.37.61.

Q: What does an attacker need to exploit this issue?

The issue is remotely reachable and requires no attacker privileges, but it requires user interaction. Exploitation involves the filter[Id] parameter in the filter view.

Q: What could successful exploitation allow?

Successful cross-site scripting can affect confidentiality and integrity with scope changed, according to the supplied CVSS vector. Availability impact is not indicated.

Published Aug 12, 2024

Updated

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61.

Affected Software

1 affected component

ZoneMinder Zoneminder<1.36.34, <1.37.61

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ZoneMinder to a version that resolves this vulnerability.
Fixed in 1.36.34
Upgrade
Upgrade ZoneMinder to a version that resolves this vulnerability.
Fixed in 1.37.61

Event History

Aug 12, 2024

CVE Published

via OSV·08:46 PM

Data Sourced

via OSV·08:46 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ZoneMinder versions contain the fix?

The vulnerability is fixed in ZoneMinder versions 1.36.34 and 1.37.61.

What does an attacker need to exploit this issue?

The issue is remotely reachable and requires no attacker privileges, but it requires user interaction. Exploitation involves the filter[Id] parameter in the filter view.

What could successful exploitation allow?

Successful cross-site scripting can affect confidentiality and integrity with scope changed, according to the supplied CVSS vector. Availability impact is not indicated.

GHSA-6rrw-66rf-6g5f: XSS vulnerability in filter view

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ZoneMinder versions contain the fix?

What does an attacker need to exploit this issue?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which ZoneMinder versions contain the fix?

What does an attacker need to exploit this issue?

What could successful exploitation allow?