CVE-2024-43360

Katalog CVE

CVSS 9.8 · Critical EPSS 6,2%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada zoneminder. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

Rincian

Terbit di NVD

12 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

6,2% peluang dieksploitasi; lebih tinggi dari 93,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj exploit · advisory vendor
• https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a patch
• https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 patch
• https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 patch
• https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 patch