VDB
CVE-2017-5595
CVE-2017-5595
PUBLISHED
A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request.
EPSS 0.10% · 27.5th percentile
Risk Scores
EPSS Score
0.10%
27.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:16.04:LTS | zoneminder | 0, 1.29.0+dfsg-1, 1.29.0+dfsg-1ubuntu1 |
Timeline
- Feb 5, 2017 PoC Published
- Feb 6, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 22, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 25, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 27, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 2, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Nov 5, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-5595 third-party-advisory
- http://seclists.org/bugtraq/2017/Feb/6 third-party-advisory
- http://seclists.org/fulldisclosure/2017/Feb/11 third-party-advisory
- https://github.com/ZoneMinder/ZoneMinder/commit/8b19fca9927cdec07cc9dd09bdcf2496a5ae69b3 third-party-advisory
- http://www.openwall.com/lists/oss-security/2017/02/05/1 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-5595 third-party-advisory