CVE-2022-39291

MEDIUM
Published Oct 7, 20223y ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Oct 7, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS Details

Base Score
5.4
Exploitability
2.8
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability Low

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 2

VendorProductVersionRange
zoneminderzoneminder* <1.36.27
zoneminderzoneminder*>1.37.0  –  <1.37.24

References 6

  • packetstormsecurity.com http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html
  • github.com https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/commit/cb3fc5907da21a5111ae54128a5d0b49ae755e9b
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/commit/de2866f9574a2bf2690276fad53c91d607825408
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
    ExploitPatchThird Party Advisory

Remediation

  • github.com https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/commit/cb3fc5907da21a5111ae54128a5d0b49ae755e9b
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/commit/de2866f9574a2bf2690276fad53c91d607825408
    PatchThird Party Advisory
  • github.com https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
    ExploitPatchThird Party Advisory