Описание
A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 and requires a different attack method.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | needs-triage | |
| esm-apps-legacy/xenial | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| esm-apps/resolute | needs-triage | |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needs-triage |
Показывать по
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 and requires a different attack method.
A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows ...
A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 and requires a different attack method.
ALT-PU-2022-2771: package `zoneminder` update to version 1.36.26-alt1
ALT-PU-2022-2575: package `zoneminder` update to version 1.36.25-alt1
EPSS
5.4 Medium
CVSS3