1. Home
  2. CVE Database
  3. CVE-2023-26037
HIGH · 8.9

CVE-2023-26037

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. Th...

Vulnerability Description

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.

CVSS Score

8.9

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW

Affected Products

VendorProductVersions
ZoneminderZoneminder< 1.36.33

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2023-26037?

CVE-2023-26037 is a vulnerability with a CVSS score of 8.9 (HIGH). ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. Th...

How severe is CVE-2023-26037?

CVE-2023-26037 has been rated HIGH with a CVSS base score of 8.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-26037?

Check the references section above for vendor advisories and patch information. Affected products include: Zoneminder Zoneminder.