CVE-2023-26037highCWE-89

CVE-2023-26037: fallo de gravedad alta en zoneminder

ZoneMinder contains SQL Injection via report_event_audit

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear zoneminder+ Monitorear zoneminder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.9epss 0.6%
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Productos afectados
ZoneMinder · zoneminder
CVEs relacionadas — zoneminder

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-26035HIGHZoneMinder vulnerable to Missing AuthorizationEPSS 80.5%CVE-2024-51482CRITICALBoolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64EPSS 36.6%CVE-2022-39290HIGHCSRF key bypass using HTTP methods in zoneminderEPSS 7.9%CVE-2022-39291MEDIUMDenial of service through logs in zoneminderEPSS 7.1%CVE-2024-43360CRITICALZoneMinder Time-based SQL InjectionEPSS 6.2%CVE-2022-39285HIGHStored Cross-Site Scripting Vulnerability In File Parameter in zoneminderEPSS 5.1%