CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to…

published February 6, 2017

CVSS
—
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00451 · 37.9th percentile
Published
2017-02-06T17:00Z
EPSS history
Timeline
  • 06 FEB 17:00Z
    A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to…
    cvelistv5