by Kastro
Paper/Archive/CVE-2022-39289

CVE-2022-39289

ZoneMinder zoneminder — Database log access in ZoneMinder

EPSS 1.0%public exploitCVSS 9.1
critical.is priorityof 100
50
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 61.4.614 × 2012.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Affected

ProductAffectedFixed inSource
zoneminder< 1.36.27–CNA
zoneminder>= 1.37.0, < 1.37.24–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4refgithub.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488