Medium severity · published Oct 7, 2022
CVE-2022-39291
Denial of service through logs in zoneminder
5.4
CVSS
7.1%
EPSS
No
On KEV
Description
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
zoneminder · ZoneMinder
< 1.36.27; >= 1.37.0, <1.37.24 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39291
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39291
packetstormsecurity.com
http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html
Patch
https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
Patch
https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb238506388798d3cf92546f9e40c
Patch
https://github.com/ZoneMinder/zoneminder/commit/cb3fc5907da21a5111ae54128a5d0b49ae755e9b
Patch
https://github.com/ZoneMinder/zoneminder/commit/de2866f9574a2bf2690276fad53c91d607825408
Exploit
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74
More from zoneminder
9.9
CVE-2024-51482
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
9.8
CVE-2025-65791
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php
9.8
CVE-2024-43360
ZoneMinder Time-based SQL Injection
9.8
CVE-2023-26037
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras
9.8
CVE-2023-26036
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras