{"api_version":"1","generated_at":"2026-07-23T12:18:47+00:00","cve":"CVE-2022-39289","urls":{"html":"https://cve.report/CVE-2022-39289","api":"https://cve.report/api/cve/CVE-2022-39289.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-39289","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-39289"},"summary":{"title":"CVE-2022-39289","description":"ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-10-07 21:15:00","updated_at":"2023-07-14 18:13:00"},"problem_types":["CWE-862"],"metrics":[],"references":[{"url":"https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488","name":"https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488","refsource":"CONFIRM","tags":[],"title":"API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges · Advisory · ZoneMinder/zoneminder · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4","name":"https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4","refsource":"MISC","tags":[],"title":"Add permissions checking to API/Logs. Fixes unprivileged user being t… · ZoneMinder/zoneminder@34ffd92 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39289","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39289","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"39289","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zoneminder","cpe5":"zoneminder","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"39289","vulnerable":"1","versionEndIncluding":"1.36.27","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zoneminder","cpe5":"zoneminder","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-39289","qid":"502977","title":"Alpine Linux Security Update for zoneminder"},{"cve":"CVE-2022-39289","qid":"505844","title":"Alpine Linux Security Update for zoneminder"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-39289","STATE":"PUBLIC","TITLE":"Database log access in ZoneMinder"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"zoneminder","version":{"version_data":[{"version_value":"< 1.36.27"},{"version_value":">= 1.37.0, < 1.37.24"}]}}]},"vendor_name":"ZoneMinder"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]},{"description":[{"lang":"eng","value":"CWE-287: Improper Authentication"}]}]},"references":{"reference_data":[{"name":"https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4","refsource":"MISC","url":"https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4"},{"name":"https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488","refsource":"CONFIRM","url":"https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488"}]},"source":{"advisory":"GHSA-mpcx-3gvh-9488","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-10-07 21:15:00","lastModifiedDate":"2023-07-14 18:13:00","problem_types":["CWE-862"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*","versionStartIncluding":"1.37.0","versionEndExcluding":"1.37.24","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*","versionEndIncluding":"1.36.27","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}