PT-2019-18541

CVE-2019-7336

Published

2019-02-04

Updated

2020-02-17

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4

Description A Self-Stored Cross Site Scripting (XSS) issue exists, where user input is saved into the session and retrieved later without proper output filtration. Specifically, the values of the MonitorName and Source parameters are displayed insecurely when the view parameter is set to cycle.

Recommendations For ZoneMinder versions prior to 1.32.4, update to version 1.32.4 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2019-7336

ALT-PU-2020-1092