ALT-PU-2022-2858

Высокий

ALT-PU-2022-2858: package zoneminder update to version 1.36.29-alt1

Источник

errata.altlinux.org

Дата публикации

17.10.2022

Дата обновления

17.10.2022

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades zoneminder to version 1.36.29-alt1.

Устраненные уязвимости4

CVE-2022-39285

Средний 5.4

Дата публикации: 07.10.2022

CWE-79

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions 1.36.27 and 1.37.24. Users are advised to upgrade. Users unable to upgrade should disable database logging.

CVSS 3.1

Средний 5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Ссылки

CVE-2022-39285 https://nvd.nist.gov/vuln/detail/CVE-2022-39285

Ссылки1

ALT-PU-2022-2858 https://errata.altlinux.org/ALT-PU-2022-2858

Связанные уязвимости

ALT-PU-2022-2978

CVSS3: 7.5

altlinux

около 4 лет назад

ALT-PU-2022-2978: package `zoneminder` update to version 1.36.29-alt1

CVE-2022-39285

CVSS3: 5.4

ubuntu

около 4 лет назад

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.

CVE-2022-39285

CVSS3: 5.4

nvd

около 4 лет назад

ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.

CVE-2022-39285

CVSS3: 5.4

debian

около 4 лет назад

ZoneMinder is a free, open source Closed-circuit television software a ...

CVE-2022-39289

CVSS3: 7.5

ubuntu

около 4 лет назад

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.