CVE-2023-26037CWE-89

ZoneMinder contains SQL Injection via report_event_audit

High · published February 25, 2023

CVSS v3.1
8.9
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00607 · 48.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-02-25T01:18Z
EPSS history
Timeline
  • 25 FEB 01:18Z
    ZoneMinder contains SQL Injection via report_event_audit
    cvelistv5