CVE-2023-26036 ZoneMinder contains Local File Inclusion vulnerability

2023-02-2501:13:30

CWE-426

GitHub_M

www.cve.org

zoneminder

local file inclusion

vulnerability

patched

linux

cctv application

ip cameras

usb cameras

analog cameras

security

patch.

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.4%

JSON

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like “…/./”, which get replaced by “…/”. This issue is patched in versions 1.36.33 and 1.37.33.

CNA Affected

[
  {
    "vendor": "ZoneMinder",
    "product": "zoneminder",
    "versions": [
      {
        "version": "< 1.36.33",
        "status": "affected"
      },
      {
        "version": ">= 1.37.0, < 1.37.33",
        "status": "affected"
      }
    ]
  }
]