{"id":"CVE-2016-10206","aliases":["DEBIAN-CVE-2016-10206","EUVD-2016-1391","GHSA-8rjm-4xf2-pmw3","MGASA-2017-0162","UBUNTU-CVE-2016-10206"],"status":"published","title":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote...","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0069,"percentile":0.53035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2017-03-03T15:00:00Z","modified":"2026-10-24T10:31:05Z","fixes":[{"ecosystem":"Debian:12","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-1.1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Sys-MemInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.910.0-1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.1-8","1.29.0+dfsg-1","1.29.0+dfsg-1ubuntu1","1.29.0+dfsg-1ubuntu2","1.29.0+dfsg-1ubuntu2+esm1"]}],"products":[{"vendor":"zoneminder","product":"zoneminder"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/02/05/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","evidence","report"]},{"url":"http://www.securityfocus.com/bid/97114","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.foxmole.com/advisories/foxmole-2016-07-05.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10206"},{"url":"https://github.com/advisories/GHSA-8rjm-4xf2-pmw3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10206","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0162.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20215","tags":["report"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/releases/tag/1.30.2","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/releases","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/c5906a5d4f9adc7bdaabcf035fe223997883018b","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/pull/1764","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/ea5342abd2ef3b7dfb1b05e59ccf420196264340","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/8b19fca9927cdec07cc9dd09bdcf2496a5ae69b3","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10206","tags":["report"]},{"url":"http://seclists.org/bugtraq/2017/Feb/5","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10206","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-10206","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2017-03-03T15:00:00Z","modified":"2024-08-06T03:14:42.662Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1391","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2017-03-03T15:00:00Z","modified":"2024-08-06T03:14:42Z","updated_at":"2026-11-03T02:22:24.738409Z"}],"ghsa":[{"id":"GHSA-8rjm-4xf2-pmw3","title":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote...","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2022-05-17T02:53:15Z","modified":"2023-01-27T05:06:01Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:42:49.311822Z"}],"nvd":[{"id":"CVE-2016-10206","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2017-03-03T15:59:00.617Z","modified":"2026-06-17T00:39:17.003Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-10206","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2017-03-03T15:59:00.617Z","modified":"2026-10-24T10:31:05.175711078Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10206","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2017-03-03T15:59:00.617Z","modified":"2026-09-22T07:02:53.604661915Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-10206","description":"Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.","status":"published","published":"2017-03-03T15:59:00Z","modified":"2025-09-08T16:43:58Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"MGASA-2017-0162","title":"Updated zoneminder packages fix security vulnerability","description":"This update fixes the following security issues:\n\nInformation disclosure and authentication bypass vulnerability exists in\nthe Apache HTTP Server configuration bundled with ZoneMinder v1.30 and\nv1.29, which allows a remote unauthenticated attacker to browse all\ndirectories in the web root, e.g., a remote unauthenticated attacker can\nview all CCTV images on the server via the /events URI. (CVE-2016-10140)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\nformat parameter in a download log request to index.php. (CVE-2016-10201)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\npath info to index.php. (CVE-2016-10202)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\nname when creating a new monitor. (CVE-2016-10203)\n\nSQL injection vulnerability in Zoneminder 1.30 and earlier allows remote\nattackers to execute arbitrary SQL commands via the limit parameter in a\nlog query request to index.php. (CVE-2016-10204)\n\nSession fixation vulnerability in Zoneminder 1.30 and earlier allows\nremote attackers to hijack web sessions via the ZMSESSID cookie.\n(CVE-2016-10205)\n\nCross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and\nearlier allows remote attackers to hijack the authentication of users for\nrequests that change passwords and possibly have unspecified other impact\nas demonstrated by a crafted user action request to index.php.\n(CVE-2016-10206)\n\nMultiple reflected XSS vulnerabilities exist within form and link input\nparameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web\napplication, which allows a remote attacker to execute malicious scripts\nwithin an authenticated client's browser. The URL is /zm/index.php and\nsample parameters could include action=login\u0026view=postlogin[XSS]\nview=console[XSS] view=groups[XSS]\nview=events\u0026filter[terms][1][cnj]=and[XSS]\nview=events\u0026filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS]\nview=events\u0026filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and\nview=events\u0026limit=1%22%3E%3C/a%3E[XSS] (among others). (CVE-2017-5367)\n\nZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is\nvulnerable to CSRF (Cross Site Request Forgery) which allows a remote\nattack to make changes to the web application as the current logged in\nvictim. If the victim visits a malicious web page, the attacker can\nsilently and automatically create a new admin user within the web\napplication for remote persistence and further attacks. The URL is\n/zm/index.php and sample parameters could include action=user uid=0\nnewUser[Username]=attacker1 newUser[Password]=Password1234\nconf_password=Password1234 newUser[System]=Edit (among others).\n(CVE-2017-5368)\n\nA file disclosure and inclusion vulnerability exists in web/views/file.php\nin ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being\npassed to readfile(), which allows an authenticated attacker to read local\nsystem files (e.g., /etc/passwd) in the context of the web server user\n(www-data). The attack vector is a .. (dot dot) in the path parameter\nwithin a zm/index.php?view=file\u0026path= request. (CVE-2017-5595)\n\nA Cross-Site Scripting (XSS) was discovered in ZoneMinder 1.30.2. The\nvulnerability exists due to insufficient filtration of user-supplied data\n(postLoginQuery) passed to the\n\"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An\nattacker could execute arbitrary HTML and script code in a browser in the\ncontext of the vulnerable website. (CVE-2017-7203)\n\nNotes for sysadmins:\n1. CRSF attacks are now blocked by setting the ZoneMinder variable\n   'ENABLE_CSRF_MAGIC' to 'yes'. During system update you may want to\n   check that this variable is set. In Mageia 'yes' is the default for new\n   installs of ZoneMInder.\n2. Changes have been made to /etc/httpd/conf/site.d/zoneminder.conf to\n   mitigate CVE-2016-10140. Make sure to accept the new configuration when\n   updating existing systems.\n","status":"published","published":"2017-06-09T23:05:58Z","modified":"2026-04-16T06:26:24.816066595Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}