CVE-2008-3881 — Cross-site Scripting in Zoneminder

CWE-79 — Cross-site ScriptingCWE-77 — Command InjectionCWE-89 — SQL Injection6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 47.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ZoneminderDebian Zoneminder
Timeline
PublishedSep 2
Latest updateMay 2

Description

Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/zoneminder< zoneminder 1.24.1-1 (bookworm)
▶Debianzoneminder/zoneminder< 1.24.1-1+3
▶NVDzoneminder/zoneminder1.23.3+36

🔴Vulnerability Details

2
GHSA
GHSA-rwrr-6cq9-73w2: Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1↗2022-05-02
▶
OSV
CVE-2008-3881: Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1↗2008-09-02
▶

📋Vendor Advisories

2
Red Hat
zoneminder: command injection, SQL injection and multiple XSS issues (CVE-2008-3882, CVE-2008-3880, CVE-2008-3881)↗2008-08-26
▶
Debian
CVE-2008-3881: zoneminder - Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and ear...↗2008
▶

💬Community

1
Bugzilla
zoneminder: command injection, SQL injection and multiple XSS issues (CVE-2008-3882, CVE-2008-3880, CVE-2008-3881)↗2008-08-27
▶