CVE-2024-43360 - Vulnerability Details

Vendors	Products
Zoneminder	Zoneminder

Link	Providers
https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a
https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6
https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397
https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj

Type	Values Removed	Values Added
First Time appeared		Zoneminder Zoneminder zoneminder
CPEs		cpe:2.3:a:zoneminder:zoneminder::::::::
Vendors & Products		Zoneminder Zoneminder zoneminder
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
Title		ZoneMinder Time-based SQL Injection
Weaknesses		CWE-89
References		https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43360", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-09T14:23:55.511Z", "datePublished": "2024-08-12T20:55:14.760Z", "dateUpdated": "2024-08-15T19:00:59.189Z"}, "containers": {"cna": {"title": "ZoneMinder Time-based SQL Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj"}, {"name": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a", "tags": ["x_refsource_MISC"], "url": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a"}, {"name": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6", "tags": ["x_refsource_MISC"], "url": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6"}, {"name": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397", "tags": ["x_refsource_MISC"], "url": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397"}, {"name": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5", "tags": ["x_refsource_MISC"], "url": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5"}], "affected": [{"vendor": "ZoneMinder", "product": "zoneminder", "versions": [{"version": "< 1.36.34", "status": "affected"}, {"version": ">= 1.37.0, < 1.37.61", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-12T20:55:14.760Z"}, "descriptions": [{"lang": "en", "value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61."}], "source": {"advisory": "GHSA-9cmr-7437-v9fj", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "zoneminder", "product": "zoneminder", "cpes": ["cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "\\u003c.1.36.34", "status": "affected"}, {"version": "1.37.0", "status": "affected", "lessThanOrEqual": "1.37.61", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T18:53:18.459320Z", "id": "CVE-2024-43360", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:00:59.189Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-43360 (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

state : PUBLISHED (string)

assignerShortName : GitHub_M (string)

dateReserved : 2024-08-09T14:23:55.511Z (string)

datePublished : 2024-08-12T20:55:14.760Z (string)

dateUpdated : 2024-08-15T19:00:59.189Z (string)

}

containers : { »

cna : { »

title : ZoneMinder Time-based SQL Injection (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-89 (string)

lang : en (string)

description : CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (string)

type : CWE (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

]

references : [ »

0 : { »

name : https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj (string)

}

1 : { »

name : https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a (string)

}

2 : { »

name : https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 (string)

}

3 : { »

name : https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 (string)

}

4 : { »

name : https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 (string)

}

]

affected : [ »

0 : { »

vendor : ZoneMinder (string)

product : zoneminder (string)

versions : [ »

0 : { »

version : < 1.36.34 (string)

status : affected (string)

}

1 : { »

version : >= 1.37.0, < 1.37.61 (string)

status : affected (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2024-08-12T20:55:14.760Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61. (string)

}

]

source : { »

advisory : GHSA-9cmr-7437-v9fj (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : zoneminder (string)

product : zoneminder (string)

cpes : [ »

0 : cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : \u003c.1.36.34 (string)

status : affected (string)

}

1 : { »

version : 1.37.0 (string)

status : affected (string)

lessThanOrEqual : 1.37.61 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-15T18:53:18.459320Z (string)

id : CVE-2024-43360 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-15T19:00:59.189Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43360", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-15T18:53:18.459320Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*"], "vendor": "zoneminder", "product": "zoneminder", "versions": [{"status": "affected", "version": "\\u003c.1.36.34"}, {"status": "affected", "version": "1.37.0", "versionType": "custom", "lessThanOrEqual": "1.37.61"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:00:54.746Z"}}], "cna": {"title": "ZoneMinder Time-based SQL Injection", "source": {"advisory": "GHSA-9cmr-7437-v9fj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ZoneMinder", "product": "zoneminder", "versions": [{"status": "affected", "version": "< 1.36.34"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.61"}]}], "references": [{"url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj", "name": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a", "name": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6", "name": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397", "name": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5", "name": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-12T20:55:14.760Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43360", "state": "PUBLISHED", "dateUpdated": "2024-08-15T19:00:59.189Z", "dateReserved": "2024-08-09T14:23:55.511Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-12T20:55:14.760Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-43360 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-15T18:53:18.459320Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* (string)

]

vendor : zoneminder (string)

product : zoneminder (string)

versions : [ »

0 : { »

status : affected (string)

version : \u003c.1.36.34 (string)

}

1 : { »

status : affected (string)

version : 1.37.0 (string)

versionType : custom (string)

lessThanOrEqual : 1.37.61 (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-15T19:00:54.746Z (string)

}

]

cna : { »

title : ZoneMinder Time-based SQL Injection (string)

source : { »

advisory : GHSA-9cmr-7437-v9fj (string)

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 9.8 (number)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : ZoneMinder (string)

product : zoneminder (string)

versions : [ »

0 : { »

status : affected (string)

version : < 1.36.34 (string)

}

1 : { »

status : affected (string)

version : >= 1.37.0, < 1.37.61 (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj (string)

name : https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

}

1 : { »

url : https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a (string)

name : https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

2 : { »

url : https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 (string)

name : https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

3 : { »

url : https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 (string)

name : https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

4 : { »

url : https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 (string)

name : https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-89 (string)

description : CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2024-08-12T20:55:14.760Z (string)

}

cveMetadata : { »

cveId : CVE-2024-43360 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-15T19:00:59.189Z (string)

dateReserved : 2024-08-09T14:23:55.511Z (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

datePublished : 2024-08-12T20:55:14.760Z (string)

assignerShortName : GitHub_M (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*", "matchCriteriaId": "E534CF78-63E9-4A19-A0E6-C7D2642FBA54", "versionEndExcluding": "1.36.34", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F041298-326C-4833-9B77-611CE8A4E800", "versionEndExcluding": "1.37.61", "versionStartIncluding": "1.37.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61."}, {"lang": "es", "value": "ZoneMinder es una aplicaci\u00f3n de software de circuito cerrado de televisi\u00f3n de c\u00f3digo abierto y gratuita. ZoneMinder se ve afectado por una vulnerabilidad de inyecci\u00f3n SQL basada en el tiempo. Esta vulnerabilidad se solucion\u00f3 en 1.36.34 y 1.37.61."}], "id": "CVE-2024-43360", "lastModified": "2024-09-04T21:42:20.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-08-12T21:15:33.813", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E534CF78-63E9-4A19-A0E6-C7D2642FBA54 (string)

versionEndExcluding : 1.36.34 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1F041298-326C-4833-9B77-611CE8A4E800 (string)

versionEndExcluding : 1.37.61 (string)

versionStartIncluding : 1.37.00 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61. (string)

}

1 : { »

lang : es (string)

value : ZoneMinder es una aplicación de software de circuito cerrado de televisión de código abierto y gratuita. ZoneMinder se ve afectado por una vulnerabilidad de inyección SQL basada en el tiempo. Esta vulnerabilidad se solucionó en 1.36.34 y 1.37.61. (string)

}

]

id : CVE-2024-43360 (string)

lastModified : 2024-09-04T21:42:20.023 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : security-advisories@github.com (string)

type : Secondary (string)

}

]

}

published : 2024-08-12T21:15:33.813 (string)

references : [ »

0 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a (string)

}

1 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 (string)

}

2 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 (string)

}

3 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 (string)

}

4 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Exploit (string)

1 : Vendor Advisory (string)

]

url : https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj (string)

}

]

sourceIdentifier : security-advisories@github.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-89 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-89 (string)

}

]

source : security-advisories@github.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object