Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).
References
| Link | Resource |
|---|---|
| http://seclists.org/bugtraq/2017/Feb/6 | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2017/Feb/11 | Exploit Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/96120 | |
| http://seclists.org/bugtraq/2017/Feb/6 | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2017/Feb/11 | Exploit Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/96120 |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://seclists.org/bugtraq/2017/Feb/6 - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2017/Feb/11 - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://www.securityfocus.com/bid/96120 - |
Information
Published : 2017-02-06 17:59
Updated : 2024-11-21 03:27
NVD link : CVE-2017-5367
Mitre link : CVE-2017-5367
CVE.ORG link : CVE-2017-5367
JSON object : View
Products Affected
zoneminder
- zoneminder
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')