p PatchFirst

CVE-2016-10140

CVE-2016-10140

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

CVSS 7.5 · High · EPSS 6.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • zoneminder Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.30.4+dfsg-1

    Update to 1.30.4+dfsg-1

  • zoneminder Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.30.4+dfsg-1

    Update to 1.30.4+dfsg-1

  • zoneminder Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.30.4+dfsg-1

    Update to 1.30.4+dfsg-1

  • zoneminder Ubuntu:Pro:16.04:LTS

    Versions
    • 1.28.1-8
    • 1.29.0+dfsg-1
    • 1.29.0+dfsg-1ubuntu1
    • 1.29.0+dfsg-1ubuntu2
    • 1.29.0+dfsg-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →