by Kastro
Paper/Archive/CVE-2022-29806

CVE-2022-29806

mitre — ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

EPSS 67%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.3.993 × 2019.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refforums.zoneminder.com/viewtopic.php?t=31638refgithub.com/ZoneMinder/zoneminder/releases/tag/1.36.13refgithub.com/ZoneMinder/zoneminder/commit/9fee64b62fbdff5bf5ece1d617f1f53c7b1967cbrefkrastanoel.com/cve/2022-29806refpacketstormsecurity.com/files/166980/ZoneMinder-Language-Settings-Remote-Code-Execution.html