Every CVE Search/ Get API key

CVE-2022-39289

Database log access in ZoneMinder

9.1 CriticalFix available

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.95%Up 0.1 points since Oct 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 9.1

Database log access in ZoneMinder

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
CVE-2022-39289
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
EUVDEUVD-2022-41787 9.1

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
EUVD-2022-41787
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
NVD 9.1

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
CVE-2022-39289
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-200, CWE-287, CWE-862
Updated
2026-11-02
OSVALPINE-CVE-2022-39289 7.5

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
ALPINE-CVE-2022-39289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 9.1

Database log access in ZoneMinder

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
CVE-2022-39289
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
OSVDEBIAN-CVE-2022-39289 7.5

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
DEBIAN-CVE-2022-39289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVUBUNTU-CVE-2022-39289 9.1

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Record
UBUNTU-CVE-2022-39289
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zoneminder
Alpine:v3.17
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.18
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.19
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.20
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.21
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.22
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.23
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Alpine:v3.24
 1.37.0 up to 1.36.31-r0
1.36.31-r0
zoneminder
Debian:12
 before 1.36.31+dfsg1-1
1.36.31+dfsg1-1
zoneminder
Debian:13
 before 1.36.31+dfsg1-1
1.36.31+dfsg1-1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
zoneminder
Debian:14
 before 1.36.31+dfsg1-1
1.36.31+dfsg1-1
zoneminder
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.28.1-81.29.0+dfsg-11.29.0+dfsg-1ubuntu11.29.0+dfsg-1ubuntu21.29.0+dfsg-1ubuntu2+esm1
 None known
zoneminder
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.32.3-2build11.32.3-2ubuntu11.32.3-2ubuntu21.32.3-2ubuntu2+esm1
 None known
zoneminder
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.36.7+dfsg1-11.36.10+dfsg1-11.36.11+dfsg1-11.36.12+dfsg1-11.36.12+dfsg1-1ubuntu0.1~esm1
 None known
zoneminder
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.36.33+dfsg1-1build11.36.33+dfsg1-1build21.36.33+dfsg1-1build31.36.33+dfsg1-1build4
 None known
zoneminder
Ubuntu:25.10
 All versions, plus listed versions
1.36.35+dfsg1-1
 None known
zoneminder
Ubuntu:26.10
 All versions, plus listed versions
1.36.37+dfsg1-1
 None known
zoneminder
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.36.35+dfsg1-11.36.37+dfsg1-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39289 is a critical vulnerability (CVSS 9.1) in Zoneminder, published October 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in zoneminder 1.36.31-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open