VDB

CVE-2022-39291

CVE-2022-39291 PUBLISHED KEV CVSS 5.400000095367432 MEDIUM

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.

EPSS 5.43% · 92.1th percentile

Risk Scores

CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score
5.43%
92.1th percentile

Affected Products

VendorProductVersions
ZoneMinderzoneminder< 1.36.27, >= 1.37.0, <1.37.24
zoneminderzoneminder0, 1.37.0

Timeline

  • Oct 7, 2022 CVE Published
  • Oct 8, 2022 EPSS Score
  • Nov 21, 2022 EPSS Score
  • Feb 18, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 27, 2023 PoC Published
  • Mar 27, 2023 PoC Published
  • Apr 3, 2023 EPSS Score
  • May 17, 2023 EPSS Score
  • Aug 13, 2023 EPSS Score
  • Sep 27, 2023 EPSS Score
  • Nov 10, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›