CVE-2022-39289

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-39289

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39289.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-39289

Aliases

GHSA-mpcx-3gvh-9488

Downstream

DEBIAN-CVE-2022-39289

UBUNTU-CVE-2022-39289

Published

2022-10-07T00:00:00Z

Modified

2025-12-04T10:35:50.702798Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Database log access in ZoneMinder

Details

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39289.json",
    "cwe_ids": [
        "CWE-200",
        "CWE-287"
    ]
}

References

Affected packages

Git / github.com/zoneminder/zoneminder

Affected ranges

Type: GIT
Repo: https://github.com/zoneminder/zoneminder
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

5f8ca42d9681e0bfd82c096cae28f0fa08eed5fa

Affected versions

1.*

1.30.1-rc.1

1.30.2

1.30.2-rc.1

1.30.3

1.30.4

1.32.0

1.32.1

1.32.2

1.32.3

1.34.0

1.34.1

1.34.10

1.34.11

1.34.12

1.34.13

1.34.14

1.34.15

1.34.16

1.34.17

1.34.18

1.34.19

1.34.2

1.34.20

1.34.21

1.34.22

1.34.23

1.34.24

1.34.25

1.34.26

1.34.3

1.34.4

1.34.5

1.34.6

1.34.7

1.34.8

1.34.9

1.36.0

1.36.1

1.36.10

1.36.11

1.36.12

1.36.13

1.36.14

1.36.15

1.36.16

1.36.17

1.36.18

1.36.2

1.36.20

1.36.21

1.36.22

1.36.23

1.36.24

1.36.25

1.36.26

1.36.3

1.36.4

1.36.6

1.36.7

1.36.8

1.36.9

Other

list

v1.*

v1.25

v1.26-beta.1

v1.26-beta.2

v1.26-beta.3

v1.26.0

v1.26.1

v1.26.2

v1.26.3

v1.26.4

v1.26.5

v1.27.0

v1.28.0

v1.29.0

v1.29.0-rc1

v1.29.0-rc2

v1.30.0

v1.30.0-rc1

v1.30.0-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39289.json"