{"id":"CVE-2017-5595","aliases":["DEBIAN-CVE-2017-5595","DLA-1145-1","EUVD-2017-14694","GHSA-88gp-83c5-44hg","MGASA-2017-0162","UBUNTU-CVE-2017-5595"],"status":"published","title":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x...","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00451,"percentile":0.39466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-02-06T17:00:00Z","modified":"2026-10-20T10:47:50Z","fixes":[{"ecosystem":"Debian:12","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"zoneminder","fixed_in":["1.25.0-4+deb7u2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-4+deb7u2"}]}],"versions":["1.25.0-4","1.25.0-4+deb7u1"]},{"source":"osv","ecosystem":"Mageia:5","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-1.1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Sys-MemInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.910.0-1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.1-8","1.29.0+dfsg-1","1.29.0+dfsg-1ubuntu1","1.29.0+dfsg-1ubuntu2","1.29.0+dfsg-1ubuntu2+esm1"]}],"products":[{"vendor":"zoneminder","product":"zoneminder"}],"references":[{"url":"http://seclists.org/fulldisclosure/2017/Feb/11","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","VDB Entry","fix","report"]},{"url":"http://www.securityfocus.com/bid/96125","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/8b19fca9927cdec07cc9dd09bdcf2496a5ae69b3","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"http://seclists.org/bugtraq/2017/Feb/6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","VDB Entry","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5595"},{"url":"https://github.com/advisories/GHSA-88gp-83c5-44hg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5595","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0162.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20215","tags":["report"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/releases/tag/1.30.2","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/releases","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/c5906a5d4f9adc7bdaabcf035fe223997883018b","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/pull/1764","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/ea5342abd2ef3b7dfb1b05e59ccf420196264340","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5595","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/02/05/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5595","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5595","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2017-02-06T17:00:00Z","modified":"2024-08-05T15:04:15.359Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14694","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2017-02-06T17:00:00Z","modified":"2024-08-05T15:04:15Z","updated_at":"2026-11-03T02:39:14.545495Z"}],"ghsa":[{"id":"GHSA-88gp-83c5-44hg","title":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x...","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2022-05-17T02:59:42Z","modified":"2023-01-27T05:06:22Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:42:54.023332Z"}],"nvd":[{"id":"CVE-2017-5595","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2017-02-06T17:59:00.577Z","modified":"2026-06-17T01:20:48.4Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"CVE-2017-5595","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2017-02-06T17:59:00.577Z","modified":"2026-10-20T10:47:50.065459007Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5595","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2017-02-06T17:59:00.577Z","modified":"2026-09-01T20:03:48.707731465Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-5595","description":"A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file\u0026path= request.","status":"published","published":"2017-02-06T17:59:00Z","modified":"2025-09-08T16:44:07Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-1145-1","title":"zoneminder - security update","status":"published","published":"2017-10-26T00:00:00Z","modified":"2026-03-09T01:00:56.38152Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0162","title":"Updated zoneminder packages fix security vulnerability","description":"This update fixes the following security issues:\n\nInformation disclosure and authentication bypass vulnerability exists in\nthe Apache HTTP Server configuration bundled with ZoneMinder v1.30 and\nv1.29, which allows a remote unauthenticated attacker to browse all\ndirectories in the web root, e.g., a remote unauthenticated attacker can\nview all CCTV images on the server via the /events URI. (CVE-2016-10140)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\nformat parameter in a download log request to index.php. (CVE-2016-10201)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\npath info to index.php. (CVE-2016-10202)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\nname when creating a new monitor. (CVE-2016-10203)\n\nSQL injection vulnerability in Zoneminder 1.30 and earlier allows remote\nattackers to execute arbitrary SQL commands via the limit parameter in a\nlog query request to index.php. (CVE-2016-10204)\n\nSession fixation vulnerability in Zoneminder 1.30 and earlier allows\nremote attackers to hijack web sessions via the ZMSESSID cookie.\n(CVE-2016-10205)\n\nCross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and\nearlier allows remote attackers to hijack the authentication of users for\nrequests that change passwords and possibly have unspecified other impact\nas demonstrated by a crafted user action request to index.php.\n(CVE-2016-10206)\n\nMultiple reflected XSS vulnerabilities exist within form and link input\nparameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web\napplication, which allows a remote attacker to execute malicious scripts\nwithin an authenticated client's browser. The URL is /zm/index.php and\nsample parameters could include action=login\u0026view=postlogin[XSS]\nview=console[XSS] view=groups[XSS]\nview=events\u0026filter[terms][1][cnj]=and[XSS]\nview=events\u0026filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS]\nview=events\u0026filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and\nview=events\u0026limit=1%22%3E%3C/a%3E[XSS] (among others). (CVE-2017-5367)\n\nZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is\nvulnerable to CSRF (Cross Site Request Forgery) which allows a remote\nattack to make changes to the web application as the current logged in\nvictim. If the victim visits a malicious web page, the attacker can\nsilently and automatically create a new admin user within the web\napplication for remote persistence and further attacks. The URL is\n/zm/index.php and sample parameters could include action=user uid=0\nnewUser[Username]=attacker1 newUser[Password]=Password1234\nconf_password=Password1234 newUser[System]=Edit (among others).\n(CVE-2017-5368)\n\nA file disclosure and inclusion vulnerability exists in web/views/file.php\nin ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being\npassed to readfile(), which allows an authenticated attacker to read local\nsystem files (e.g., /etc/passwd) in the context of the web server user\n(www-data). The attack vector is a .. (dot dot) in the path parameter\nwithin a zm/index.php?view=file\u0026path= request. (CVE-2017-5595)\n\nA Cross-Site Scripting (XSS) was discovered in ZoneMinder 1.30.2. The\nvulnerability exists due to insufficient filtration of user-supplied data\n(postLoginQuery) passed to the\n\"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An\nattacker could execute arbitrary HTML and script code in a browser in the\ncontext of the vulnerable website. (CVE-2017-7203)\n\nNotes for sysadmins:\n1. CRSF attacks are now blocked by setting the ZoneMinder variable\n   'ENABLE_CSRF_MAGIC' to 'yes'. During system update you may want to\n   check that this variable is set. In Mageia 'yes' is the default for new\n   installs of ZoneMInder.\n2. Changes have been made to /etc/httpd/conf/site.d/zoneminder.conf to\n   mitigate CVE-2016-10140. Make sure to accept the new configuration when\n   updating existing systems.\n","status":"published","published":"2017-06-09T23:05:58Z","modified":"2026-04-16T06:26:24.816066595Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}