CVE-2023-25825
Summary
| CVE | CVE-2023-25825 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-02-25 01:15:00 UTC |
|---|
| Updated | 2023-11-07 04:09:00 UTC |
|---|
| Description | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| XSS/JS-RCE in log viewing · Advisory · ZoneMinder/zoneminder · GitHub |
MISC |
github.com |
|
| Escape <> in log messages to prevent html shenanigans. Fixes #3596 · ZoneMinder/zoneminder@e1028c1 · GitHub |
MISC |
github.com |
|
| Add object-src CSP directive · ZoneMinder/zoneminder@4637eaf · GitHub |
MISC |
github.com |
|
| Correct the syntax of the CSP · ZoneMinder/zoneminder@57bf25d · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 184215 Debian Security Update for zoneminder (CVE-2023-25825)
