Description
ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZoneMinder | zoneminder | < 1.36.27, >= 1.37.0, < 1.37.24 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zoneminder | 1.36.31+dfsg1-1 | — |
| Debian 13 | zoneminder | 1.36.31+dfsg1-1 | — |
| Debian 12 | zoneminder | 1.36.31+dfsg1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zoneminder | No fix yet | — |
| Ubuntu 26.04 LTS | zoneminder | No fix yet | — |
| Ubuntu 25.10 | zoneminder | No fix yet | — |
| Ubuntu 24.04 LTS | zoneminder | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 20.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 16.04 LTS | zoneminder | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | zoneminder | 1.36.31-r0 | — |
| Alpine v3.23 | zoneminder | 1.36.31-r0 | — |
| Alpine v3.22 | zoneminder | 1.36.31-r0 | — |
| Alpine v3.21 | zoneminder | 1.36.31-r0 | — |
| Alpine v3.20 | zoneminder | 1.36.31-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | zoneminder | 1.36.31-r0 | — |
| Alpine v3.18 | zoneminder | 1.36.31-r0 | — |
| Alpine v3.17 | zoneminder | 1.36.31-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass EDB-51071 · webapps · Mar 27, 2023 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h6xp-cvwv-q433
- https://github.com/ZoneMinder/zoneminder/commit/c0a4c05e84eea0f6ccf7169c014efe5422c9ba0d
- https://github.com/ZoneMinder/zoneminder/commit/d289eb48601a76e34feea3c1683955337b1fae59
- http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html