CVE-2008-6755 — Zoneminder vulnerability

CWE-2644 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.2%
top 56.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ZoneminderDebian Zoneminder
Timeline
PublishedApr 27
Latest updateMay 17

Description

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/zoneminder< zoneminder 1.24.1-1 (bookworm)
▶Debianzoneminder/zoneminder< 1.24.1-1+3

Patches

Patch: www.redhat.com ↗Patch: www.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-72qr-8q2q-w485: ZoneMinder 1↗2022-05-17
▶
OSV
CVE-2008-6755: ZoneMinder 1↗2009-04-27
▶

📋Vendor Advisories

1
Debian
CVE-2008-6755: zoneminder - ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache ...↗2008
▶