CVE-2023-26036CWE-426

ZoneMinder contains Local File Inclusion vulnerability

High · published February 25, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00897 · 59.2th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2023-02-25T01:13Z
EPSS history
Timeline
  • 25 FEB 01:13Z
    ZoneMinder contains Local File Inclusion vulnerability
    cvelistv5