Threats affecting pkg:github/zoneminder/zoneminder

ZoneMinder versions prior to 1.38.3 contain a command injection vulnerability in the downloadEvents() function. This occurs because the monitor Name value is manually wrapped in single quotes instead of using a proper escaping function before being used in shell commands. An attacker with monitor-create or monitor-edit permissions can store a monitor Name containing shell metacharacters, which can then be exploited by a user with Events View permission exporting events. This allows arbitrary command execution as the web server user. The issue is fixed in version 1.38.3.

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.

ZoneMinder versions before 1.38.4 contain static buffer overflow vulnerabilities in the RemoteCameraHttp::GetResponse() function. These vulnerabilities arise from processing oversized HTTP response headers sent by malicious HTTP cameras or intercepting attackers. Crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries can corrupt parser state, leading to crashes or memory corruption in the capture process.

ZoneMinder versions before 1.38.4 have a vulnerability where per-monitor access restrictions are not enforced in the FramesController index endpoint. Authenticated users with Events view permission can access frame records from monitors they should not have access to, leading to unauthorized disclosure of event and frame metadata across monitor boundaries. The vulnerability has a medium severity with a CVSS score of 4.3.