CVE-2019-7331
zoneminder: Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field...
CVE-2019-7331 is fixed in zoneminder on 1 platform by zoneminder 1.32.3-2ubuntu2+esm1 (version 1.32.3-2ubuntu2+esm1), released April 25, 2022. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0090
59th percentile
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php). There exists no input validation or output filtration, leaving it vulnerable to HTML Injection and an XSS attack.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| zoneminder · Ubuntu 20.04 LTS (focal) | 1.32.3-2ubuntu2+esm1 | zoneminder 1.32.3-2ubuntu2+esm1 | Apr 25, 2022 |