Lucene search

MitreCVE-2017-5367

HistoryFeb 06, 2017 - 5:59 p.m.

CVE-2017-5367

2017-02-0617:59:00

CWE-79

mitre

web.nvd.nist.gov

cve-2017-5367

zoneminder

xss

vulnerability

remote execution

security

cctv

server

web application

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

55.1%

JSON

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client’s browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).

Affected configurations

Nvd

Node

zoneminderzoneminderMatch1.29.0

zoneminderzoneminderMatch1.30.0

VendorProductVersionCPE
zoneminderzoneminder1.29.0cpe:2.3:a:zoneminder:zoneminder:1.29.0:*:*:*:*:*:*:*
zoneminderzoneminder1.30.0cpe:2.3:a:zoneminder:zoneminder:1.30.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zoneminder	zoneminder	1.29.0	cpe:2.3:a:zoneminder:zoneminder:1.29.0:::::::*
zoneminder	zoneminder	1.30.0	cpe:2.3:a:zoneminder:zoneminder:1.30.0:::::::*