{"api_version":"1","generated_at":"2026-07-23T09:16:52+00:00","cve":"CVE-2019-7337","urls":{"html":"https://cve.report/CVE-2019-7337","api":"https://cve.report/api/cve/CVE-2019-7337.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-7337","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-7337"},"summary":{"title":"CVE-2019-7337","description":"Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-02-04 19:29:00","updated_at":"2019-02-05 21:24:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://github.com/ZoneMinder/zoneminder/issues/2456","name":"https://github.com/ZoneMinder/zoneminder/issues/2456","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Reflected Cross Site Scripting(XSS) - events.php · Issue #2456 · ZoneMinder/zoneminder · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7337","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7337","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"7337","vulnerable":"1","versionEndIncluding":"1.32.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zoneminder","cpe5":"zoneminder","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2019-7337","qid":"502205","title":"Alpine Linux Security Update for zoneminder"},{"cve":"CVE-2019-7337","qid":"505604","title":"Alpine Linux Security Update for zoneminder"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-7337","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/ZoneMinder/zoneminder/issues/2456","refsource":"MISC","url":"https://github.com/ZoneMinder/zoneminder/issues/2456"}]}},"nvd":{"publishedDate":"2019-02-04 19:29:00","lastModifiedDate":"2019-02-05 21:24:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.7,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*","versionEndIncluding":"1.32.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"7337","Ordinal":"145083","Title":"CVE-2019-7337","CVE":"CVE-2019-7337","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"7337","Ordinal":"1","NoteData":"Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"7337","Ordinal":"2","NoteData":"2019-02-04","Type":"Other","Title":"Published"}]}}}