Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2019-7335: ZoneMinder logs page can run malicious code
CVE-2019-7335 · published 7 years ago
Summary
ZoneMinder versions up to 1.32.3 show log messages without filtering. An attacker who can add a log entry could insert HTML or JavaScript that runs in anyone viewing the logs, potentially stealing data or manipulating the interface. Upgrade to a patched version or apply a filter to log messages to stop this behavior.
What to do
- Update debian zoneminder to version 1.34.6-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | zoneminder |
< 1.34.6-1 Fix: upgrade to 1.34.6-1
|
| Debian:13 | debian | zoneminder |
< 1.34.6-1 Fix: upgrade to 1.34.6-1
|
| Debian:14 | debian | zoneminder |
< 1.34.6-1 Fix: upgrade to 1.34.6-1
|
| – | zoneminder | zoneminder |
<= 1.32.3 cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Original advisory text
Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on the web page with...
Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on the web page without applying any proper filtration. This relates to the view=logs value.
References
- https://security-tracker.debian.org/tracker/CVE-2019-7335 Vendor Advisory
- https://github.com/ZoneMinder/zoneminder/issues/2453 Exploit Third Party Advisory
Severity
6.1
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Feb 2019
Updated3 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta