CVE-2022-39285 Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
Attackers can inject malicious scripts into ZoneMinder logs, leading to code execution and account takeover when victims view the logs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39285?
CVE-2022-39285 is a high-severity cross-site scripting vulnerability in Zoneminder Zoneminder, published on 7 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.
Weakness: CWE-79
Which versions are affected by CVE-2022-39285?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2022-39285?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-39285 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39285 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2022-39285, GHSA-h6xp-cvwv-q433, UBUNTU-CVE-2022-39285.