CVE-2022-39285

Zoneminder vulnerability

CVSS

7.6

EPSS

3.8%

EPSS pct

89th

Exploited

No known

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.

Affected vendor

Zoneminder

Affected product

Zoneminder

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Weakness type (CWE)

CWE-79 — Cross-Site Scripting (XSS)

Published

2022-10-07

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring low privileges, user interaction. Successful exploitation leads to low impact to confidentiality, high impact to integrity, high impact to availability.

Its EPSS score of 3.8% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 89% of all scored CVEs.

Check your external exposure to CVE-2022-39285

Confirm whether Zoneminder Zoneminder is running on any internet-facing host or subdomain.
Match discovered service fingerprints against the version affected by CVE-2022-39285.
Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2022-39285

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2022-39285 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2022-39285?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2022-39285.

Start free scan

No credit card. Agentless.

Related vulnerabilities

HIGH

CVE-2016-8024

Virusscan Enterprise vulnerability