CVE-2017-5367 Cross-site scripting in n/a
Remote attackers can execute malicious scripts in authenticated users' browsers via reflected XSS in ZoneMinder web interface parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-5367?
CVE-2017-5367 is a medium-severity cross-site scripting vulnerability in Zoneminder Zoneminder, published on 6 Feb 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).
Weakness: CWE-79
Which versions are affected by CVE-2017-5367?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2017-5367?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-5367 being exploited?
There is no known exploitation of CVE-2017-5367 in the wild and no public exploit code.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2017-5367, GHSA-84wq-hwp8-vwxc, UBUNTU-CVE-2017-5367.