VDB

CVE-2022-39291

CVE-2022-39291 PUBLISHED CVSS 5.400000095367432 MEDIUM

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.

EPSS 7.16% · 91.7th percentile

Risk Scores

CVSS v3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score
7.16%
91.7th percentile

Affected Products

VendorProductVersions
ZoneMinderzoneminder< 1.36.27, >= 1.37.0, <1.37.24
zoneminderzoneminder0, 1.37.0

Timeline

  • Oct 7, 2022 CVE Published
  • Oct 8, 2022 EPSS Score
  • Nov 21, 2022 EPSS Score
  • Jan 4, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 27, 2023 PoC Published
  • Mar 27, 2023 PoC Published
  • Apr 2, 2023 EPSS Score
  • May 16, 2023 EPSS Score
  • Jun 29, 2023 EPSS Score
  • Sep 26, 2023 EPSS Score
  • Nov 9, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›