CVE-2018-1000832 Deserialization in n/a

Q: Is CVE-2018-1000832 being exploited?

There is no known exploitation of CVE-2018-1000832 in the wild and no public exploit code.

Critical 9.8 Published 20 Dec 2018 Updated 16 Sep 2024

Attackers can exploit unsafe deserialization in ZoneMinder to achieve remote code execution, data disclosure, or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1000832?

CVE-2018-1000832 is a critical unsafe deserialization vulnerability in Zoneminder Zoneminder, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.

Weakness: CWE-502

Which versions are affected by CVE-2018-1000832?

It affects 1 product.

Products include Zoneminder Zoneminder.

How do I fix CVE-2018-1000832?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-1000832 being exploited?

There is no known exploitation of CVE-2018-1000832 in the wild and no public exploit code.

All Zoneminder Zoneminder vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-1000832, GHSA-5h2c-x34m-pf7p, UBUNTU-CVE-2018-1000832.