CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session...
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
CVE-2019-7350- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
CVE List No score
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
CVE-2019-7350- Updated
- 2026-11-02
EUVDEUVD-2019-16893 No score
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
EUVD-2019-16893- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-823q-mrww-7v59
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session...
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
GHSA-823q-mrww-7v59- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
ALPINE-CVE-2019-7350- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
OSV
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
CVE-2019-7350- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
DEBIAN-CVE-2019-7350- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-7350
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
- Record
UBUNTU-CVE-2019-7350- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zoneminderAlpine:v3.15 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.16 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.17 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.18 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.19 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.20 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.21 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.22 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.23 |
before 1.36.7-r0 | 1.36.7-r0 |
zoneminderAlpine:v3.24 |
before 1.36.7-r0 | 1.36.7-r0 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
zoneminderDebian:12 |
All versions, plus listed versions 1.36.33+dfsg1-11.36.35+dfsg1-11.36.37+dfsg1-1 |
None known |
zoneminderDebian:13 |
All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1 |
None known |
zoneminderDebian:14 |
All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1 |
None known |
zoneminderUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.28.1-81.29.0+dfsg-11.29.0+dfsg-1ubuntu11.29.0+dfsg-1ubuntu21.29.0+dfsg-1ubuntu2+esm1 |
None known |
zoneminderUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.32.3-2build11.32.3-2ubuntu11.32.3-2ubuntu21.32.3-2ubuntu2+esm1 |
None known |
zoneminderUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.36.7+dfsg1-11.36.10+dfsg1-11.36.11+dfsg1-11.36.12+dfsg1-11.36.12+dfsg1-1ubuntu0.1~esm1 |
None known |
zoneminderUbuntu:24.04:LTS |
All versions, plus listed versions 1.36.33+dfsg1-1build11.36.33+dfsg1-1build21.36.33+dfsg1-1build31.36.33+dfsg1-1build4 |
None known |
zoneminderUbuntu:25.10 |
All versions, plus listed versions 1.36.35+dfsg1-1 |
None known |
zoneminderUbuntu:26.10 |
All versions, plus listed versions 1.36.37+dfsg1-1 |
None known |
zoneminderUbuntu:26.04:LTS |
All versions, plus listed versions 1.36.35+dfsg1-11.36.37+dfsg1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7350 is a high vulnerability (CVSS 7.3) in Zoneminder, published February 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in zoneminder 1.36.7-r0.