CVE-2016-10140 Information disclosure in n/a
Remote attackers can bypass authentication to view all CCTV images and browse directories due to insecure Apache configuration in ZoneMinder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10140?
CVE-2016-10140 is a high-severity vulnerability in Zoneminder Zoneminder, published on 13 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
Weakness: CWE-200
Which versions are affected by CVE-2016-10140?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2016-10140?
Apply the vendor's patch.
Is CVE-2016-10140 being exploited?
There is no known exploitation of CVE-2016-10140 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2016-10140, DLA-806-1, GHSA-qgrq-7wwj-vr5c, UBUNTU-CVE-2016-10140.