Self-Stored XSS Vulnerability in ZoneMinder by ZoneMinder Developers
CVE-2019-7335

6.1MEDIUM

Key Information:

Vendor

Zoneminder

Status
Zoneminder
Vendor
CVE Published:
3 October 2022

What is CVE-2019-7335?

A self-stored XSS vulnerability exists in ZoneMinder, specifically through version 1.32.3, allowing attackers to inject and execute HTML or JavaScript code. This occurs due to improper handling of log messages that are displayed on the web page without adequate filtration. Attackers can exploit the 'Log Message' value in the logs view to execute malicious scripts, potentially compromising the application and its users.

References

https://github.com/ZoneMinder/zoneminder/issues/2453
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.