CVE-2019-7328

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Reflected Cross Site Scripting (XSS) issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable scale parameter value in the view frame. This is due to the omission of proper filtration in the /js/frame.js.php endpoint, which is accessed through the frame.php file.

Recommendations For ZoneMinder versions prior to 1.32.4, update to version 1.32.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the scale parameter in the frame.php file to minimize the risk of exploitation.