CVE-2024-43359

low-risk
Published 2024-08-12

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61.

Do I need to act?

-
0.26% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance

Affected Products (1)

Affected Vendors

Zoneminder

References (3)

Patch https://github.com/ZoneMinder/zoneminder/commit/6cc64dddff6144a98680f65ecf8dc249...
Patch https://github.com/ZoneMinder/zoneminder/commit/b51c5df0cb869ca48fccfc6e6fd7c19b...
Third Party Advisory https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8
13
/ 100
low-risk
Severity 7/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal