CVE-2017-5367 - Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser

Back Back to CVE browser

MEDIUM

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser

Published Feb 6, 2017

6.1

MEDIUM

CVSS 3.0

EPSS 2.00%

Description

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

http://seclists.org/bugtraq/2017/Feb/6
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2017/Feb/11
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/96120
vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-14471
Advisory

Link	Providers	Tags
http://seclists.org/bugtraq/2017/Feb/6		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2017/Feb/11		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/96120		vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-14471		Advisory