CVE-2024-43358

Name
CVE-2024-43358
Description
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6rrw-66rf-6g5f
MISC https://github.com/ZoneMinder/zoneminder/commit/062cf568a33fb6a8604ec327b1de8bb2e0d1ff77
MISC https://github.com/ZoneMinder/zoneminder/commit/4602cd0470a3b90b18bcc44b3c86d963872d1ba0

Match rules

CPE URI Source package Min version Max version
zoneminder >= 0 < 1.36.34
zoneminder >= 1.37.0 < 1.37.61

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
zoneminder edge-community 1.36.33-r6 Kaarle Ritvanen <kunkku@alpinelinux.org> possibly vulnerable
zoneminder 3.20-community 1.36.33-r5 Kaarle Ritvanen <kunkku@alpinelinux.org> possibly vulnerable