CVE-2008-1381
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated...
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
Exploit likelihood
What each source reports
NVD Score used
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
- Record
CVE-2008-1381- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
- Record
CVE-2008-1381- Updated
- 2026-11-02
EUVDEUVD-2008-1388 No score
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
- Record
EUVD-2008-1388- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qh7-p4hh-vm8p No score
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated...
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
- Record
GHSA-5qh7-p4hh-vm8p- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
- Record
CVE-2008-1381- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1381 No score
ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.
- Record
DEBIAN-CVE-2008-1381- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zoneminderDebian:12 |
before 1.23.3-1 | 1.23.3-1 |
zoneminderDebian:13 |
before 1.23.3-1 | 1.23.3-1 |
zoneminderDebian:14 |
before 1.23.3-1 | 1.23.3-1 |
zoneminderDebian:5.0 |
before 1.23.2-2+lenny1, plus listed versions 1.22.3-11.22.3-101.22.3-31.22.3-41.22.3-6 Show 5 moreShow less1.22.3-71.22.3-81.22.3-91.23.2-11.23.2-2 |
1.23.2-2+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1381 is a high vulnerability (CVSS 7.5) in Zoneminder, published May 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in zoneminder 1.23.3-1.