CVE-2017-5367 Information

Description

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29 an open-source CCTV server web application which allows a remote attacker to execute malicious scripts within an authenticated client’s browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter5Bterms5D5B15D5Bcnj5D=and[XSS] view=events&filter5Bterms5D5B15D5Bcnj5D=[XSS]and view=events&limit=1223E3C/a3E[XSS] (among others).

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

http://seclists.org/bugtraq/2017/Feb/6 http://seclists.org/fulldisclosure/2017/Feb/11 http://www.securityfocus.com/bid/96120

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1