ZoneMinder vulnerable to SQL Injection, fix released in 1.37.64
CVE-2024-51482

10CRITICAL

Key Information:

Vendor

Zoneminder

Status
Zoneminder
Vendor
CVE Published:
31 October 2024

What is CVE-2024-51482?

ZoneMinder, a popular open-source closed-circuit television software, has a vulnerability that exposes versions v1.37.* up to and including v1.37.64 to a boolean-based SQL injection attack through the web/ajax/event.php endpoint. This flaw can allow an attacker to manipulate SQL queries, potentially leading to unauthorized data access or modification. Users are encouraged to update to version 1.37.65 or later, where this vulnerability has been addressed. For more details, refer to the official advisories and commits provided by ZoneMinder.

Affected Version(s)

zoneminder >= 1.37.0, < 1.37.65

References

https://github.com/ZoneMinder/zoneminder/security/advisor...
x_refsource_CONFIRM
https://github.com/ZoneMinder/zoneminder/commit/9e7d31841...
x_refsource_MISC

EPSS Score

41% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.