PT-2023-20330

CVE-2023-25825

Published

2023-02-25

Updated

2023-11-30

Description by

CVSS 3.1

7.7

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.33

Description The issue concerns ZoneMinder, a free, open source Closed-circuit television software application for Linux. It supports IP, USB, and Analog cameras. Log entries can be injected into the database logs, containing a malicious referrer field. This field is unescaped when viewing the logs in the web UI, leading to Cross-site Scripting.

Recommendations For versions prior to 1.36.33, update to version 1.36.33 to resolve the issue. As a temporary workaround, consider restricting access to the web UI to minimize the risk of exploitation. Avoid viewing logs in the web UI until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Daniel Hofer

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2023-25825