CVE-2022-39289 Database log access in ZoneMinder

Critical 9.1 Published 7 Oct 2022 Updated 22 Apr 2025

Unprivileged users can read, insert, modify, and delete database logs via the ZoneMinder API due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-39289?

CVE-2022-39289 is a critical missing authorization vulnerability in Zoneminder Zoneminder, published on 7 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Weakness: CWE-862, CWE-287, CWE-200

Which versions are affected by CVE-2022-39289?

It affects 1 product.

Products include Zoneminder Zoneminder.

How do I fix CVE-2022-39289?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-39289 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39289 exists.

All Zoneminder Zoneminder vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-39289, GHSA-mpcx-3gvh-9488, UBUNTU-CVE-2022-39289.