CVE-2019-7351 Other in n/a
Attackers can inject arbitrary log messages into ZoneMinder logs via crafted links, potentially misleading administrators or hiding malicious activity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-7351?
CVE-2019-7351 is a medium-severity vulnerability in Zoneminder Zoneminder, published on 4 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value.
Weakness: CWE-74
Which versions are affected by CVE-2019-7351?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2019-7351?
No fix has been published for CVE-2019-7351 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-7351 being exploited?
There is no known exploitation of CVE-2019-7351 in the wild and no public exploit code.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2019-7351, GHSA-8937-h2h2-h5rj, UBUNTU-CVE-2019-7351.