ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and automatically create a new admin user within the web application for remote persistence and further attacks. The URL is /zm/index.php and sample parameters could include action=user uid=0 newUser[Username]=attacker1 newUser[Password]=Password1234 conf_password=Password1234 newUser[System]=Edit (among others).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site     Request Forgery) which allows a remote attack to make changes to the web application as the current logged     in victim. If the victim visits a malicious web page, the attacker can silently and automatically create a     new admin user within the web application for remote persistence and further attacks. The URL is     /zm/index.php and sample parameters could include action=user uid=0 newUser[Username]=attacker1     newUser[Password]=Password1234 conf_password=Password1234 newUser[System]=Edit (among others).
    (CVE-2017-5368)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and
    v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious
    scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could
    include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS]
    view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS]
    view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among
    others). (CVE-2017-5367)

  - ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site
    Request Forgery) which allows a remote attack to make changes to the web application as the current logged
    in victim. If the victim visits a malicious web page, the attacker can silently and automatically create a
    new admin user within the web application for remote persistence and further attacks. The URL is
    /zm/index.php and sample parameters could include action=user uid=0 newUser[Username]=attacker1
    newUser[Password]=Password1234 conf_password=Password1234 newUser[System]=Edit (among others).
    (CVE-2017-5368)

ID	Name	Product	Family	Severity
254466	Linux Distros Unpatched Vulnerability : CVE-2017-5368	Nessus	Misc.	high
426549	Alpine: multiple zoneminder packages: security update to 1.30.2-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426549	Alpine: multiple zoneminder packages: security update to 1.30.2-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407978	Alpine: multiple zoneminder packages: security update to 1.30.2-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407978	Alpine: multiple zoneminder packages: security update to 1.30.2-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2017-5368

high

Tenable Plugins

high

high

high

high

high