CVE-2023-25825

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.33

Description The issue concerns ZoneMinder, a free, open source Closed-circuit television software application for Linux. It supports IP, USB, and Analog cameras. Log entries can be injected into the database logs, containing a malicious referrer field. This field is unescaped when viewing the logs in the web UI, leading to Cross-site Scripting.

Recommendations For versions prior to 1.36.33, update to version 1.36.33 to resolve the issue. As a temporary workaround, consider restricting access to the web UI to minimize the risk of exploitation. Avoid viewing logs in the web UI until the issue is resolved.