CVE-2019-7330

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable show parameter value in the "view frame" (frame.php) due to omitted proper filtration.

Recommendations For versions prior to 1.32.4, update to version 1.32.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the frame.php endpoint until a patch is available. Avoid using the show parameter in the affected frame.php endpoint until the issue is resolved.