Cross-Site Request Forgery Vulnerability in ZoneMinder Software
CVE-2019-7346

8.8HIGH

Key Information:

Vendor

Zoneminder

Status
Zoneminder
Vendor
CVE Published:
4 February 2019

What is CVE-2019-7346?

A vulnerability exists in ZoneMinder up to version 1.32.3 that allows attackers to exploit Cross-Site Request Forgery (CSRF). When a CSRF check fails, the system's callback function displays a 'Try again' button, inadvertently enabling users to resubmit a failed request. This flaw could be manipulated to facilitate unauthorized actions, leading to potential security breaches.

References

https://github.com/ZoneMinder/zoneminder/issues/2469
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.