CVE-2017-5367
CVE-2017-5367
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).
CVSS 6.1 · Medium · EPSS 2.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
zoneminder Debian:12
- Affected ranges
- ECOSYSTEM: < 1.30.4+dfsg-1
Update to 1.30.4+dfsg-1
zoneminder Debian:13
- Affected ranges
- ECOSYSTEM: < 1.30.4+dfsg-1
Update to 1.30.4+dfsg-1
zoneminder Debian:14
- Affected ranges
- ECOSYSTEM: < 1.30.4+dfsg-1
Update to 1.30.4+dfsg-1
zoneminder Ubuntu:Pro:16.04:LTS
- Versions
- 1.28.1-8
- 1.29.0+dfsg-1
- 1.29.0+dfsg-1ubuntu1
- 1.29.0+dfsg-1ubuntu2
- 1.29.0+dfsg-1ubuntu2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published