CVE-2022-39291

2022-10-0721:15:11

CWE-20

[email protected]

web.nvd.nist.gov

zoneminder

cve-2022-39291

vulnerability

log injection

http post

upgrade

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.6%

JSON

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with “View” system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the “/zm/index.php” endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.

Affected configurations

Vulners

NVD

Node

zoneminderzoneminderRange<1.36.27

zoneminderzoneminderRange1.37.0–1.37.24

VendorProductVersionCPE
zoneminderzoneminder*cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*
zoneminderzoneminder*cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zoneminder	zoneminder	*	cpe:2.3:a:zoneminder:zoneminder::::::::
zoneminder	zoneminder	*	cpe:2.3:a:zoneminder:zoneminder::::::::

CNA Affected

[
  {
    "vendor": "ZoneMinder",
    "product": "zoneminder",
    "versions": [
      {
        "version": "< 1.36.27",
        "status": "affected"
      },
      {
        "version": ">= 1.37.0, <1.37.24",
        "status": "affected"
      }
    ]
  }
]