{"id":"CVE-2017-7203","aliases":["DEBIAN-CVE-2017-7203","EUVD-2017-16240","GHSA-2h6v-4cpv-9pv7","MGASA-2017-0162","UBUNTU-CVE-2017-7203"],"status":"published","title":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists...","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00812,"percentile":0.57225,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-03-21T06:21:00Z","modified":"2026-10-20T10:50:08Z","fixes":[{"ecosystem":"Debian:12","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zoneminder","fixed_in":["1.30.4+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-1.1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:5","package":"perl-Sys-MemInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.910.0-1.mga5"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.1-8","1.29.0+dfsg-1","1.29.0+dfsg-1ubuntu1","1.29.0+dfsg-1ubuntu2","1.29.0+dfsg-1ubuntu2+esm1"]}],"products":[{"vendor":"zoneminder","product":"zoneminder"}],"references":[{"url":"https://github.com/ZoneMinder/ZoneMinder/issues/1797","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/97001","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7203"},{"url":"https://github.com/advisories/GHSA-2h6v-4cpv-9pv7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7203","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0162.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20215","tags":["report"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/releases/tag/1.30.2","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/releases","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/c5906a5d4f9adc7bdaabcf035fe223997883018b","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/pull/1764","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/ea5342abd2ef3b7dfb1b05e59ccf420196264340","tags":["web"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/commit/8b19fca9927cdec07cc9dd09bdcf2496a5ae69b3","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7203","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7203","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2017-03-21T06:21:00Z","modified":"2024-08-05T15:56:35.967Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16240","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2017-03-21T06:21:00Z","modified":"2024-08-05T15:56:35Z","updated_at":"2026-11-03T02:39:09.41676Z"}],"ghsa":[{"id":"GHSA-2h6v-4cpv-9pv7","title":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists...","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2022-05-17T00:29:27Z","modified":"2023-02-03T05:01:51Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:53:03.296613Z"}],"nvd":[{"id":"CVE-2017-7203","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2017-03-21T06:59:00.29Z","modified":"2026-06-17T01:23:51.09Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"CVE-2017-7203","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2017-03-21T06:59:00.29Z","modified":"2026-10-20T10:50:08.906823102Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7203","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2017-03-21T06:59:00.29Z","modified":"2026-09-01T20:03:49.858030495Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7203","description":"A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient filtration of user-supplied data (postLoginQuery) passed to the \"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.","status":"published","published":"2017-03-21T06:59:00Z","modified":"2025-09-08T16:44:10Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"MGASA-2017-0162","title":"Updated zoneminder packages fix security vulnerability","description":"This update fixes the following security issues:\n\nInformation disclosure and authentication bypass vulnerability exists in\nthe Apache HTTP Server configuration bundled with ZoneMinder v1.30 and\nv1.29, which allows a remote unauthenticated attacker to browse all\ndirectories in the web root, e.g., a remote unauthenticated attacker can\nview all CCTV images on the server via the /events URI. (CVE-2016-10140)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\nformat parameter in a download log request to index.php. (CVE-2016-10201)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\npath info to index.php. (CVE-2016-10202)\n\nCross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier\nallows remote attackers to inject arbitrary web script or HTML via the\nname when creating a new monitor. (CVE-2016-10203)\n\nSQL injection vulnerability in Zoneminder 1.30 and earlier allows remote\nattackers to execute arbitrary SQL commands via the limit parameter in a\nlog query request to index.php. (CVE-2016-10204)\n\nSession fixation vulnerability in Zoneminder 1.30 and earlier allows\nremote attackers to hijack web sessions via the ZMSESSID cookie.\n(CVE-2016-10205)\n\nCross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and\nearlier allows remote attackers to hijack the authentication of users for\nrequests that change passwords and possibly have unspecified other impact\nas demonstrated by a crafted user action request to index.php.\n(CVE-2016-10206)\n\nMultiple reflected XSS vulnerabilities exist within form and link input\nparameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web\napplication, which allows a remote attacker to execute malicious scripts\nwithin an authenticated client's browser. The URL is /zm/index.php and\nsample parameters could include action=login\u0026view=postlogin[XSS]\nview=console[XSS] view=groups[XSS]\nview=events\u0026filter[terms][1][cnj]=and[XSS]\nview=events\u0026filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS]\nview=events\u0026filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and\nview=events\u0026limit=1%22%3E%3C/a%3E[XSS] (among others). (CVE-2017-5367)\n\nZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is\nvulnerable to CSRF (Cross Site Request Forgery) which allows a remote\nattack to make changes to the web application as the current logged in\nvictim. If the victim visits a malicious web page, the attacker can\nsilently and automatically create a new admin user within the web\napplication for remote persistence and further attacks. The URL is\n/zm/index.php and sample parameters could include action=user uid=0\nnewUser[Username]=attacker1 newUser[Password]=Password1234\nconf_password=Password1234 newUser[System]=Edit (among others).\n(CVE-2017-5368)\n\nA file disclosure and inclusion vulnerability exists in web/views/file.php\nin ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being\npassed to readfile(), which allows an authenticated attacker to read local\nsystem files (e.g., /etc/passwd) in the context of the web server user\n(www-data). The attack vector is a .. (dot dot) in the path parameter\nwithin a zm/index.php?view=file\u0026path= request. (CVE-2017-5595)\n\nA Cross-Site Scripting (XSS) was discovered in ZoneMinder 1.30.2. The\nvulnerability exists due to insufficient filtration of user-supplied data\n(postLoginQuery) passed to the\n\"ZoneMinder-master/web/skins/classic/views/js/postlogin.js.php\" URL. An\nattacker could execute arbitrary HTML and script code in a browser in the\ncontext of the vulnerable website. (CVE-2017-7203)\n\nNotes for sysadmins:\n1. CRSF attacks are now blocked by setting the ZoneMinder variable\n   'ENABLE_CSRF_MAGIC' to 'yes'. During system update you may want to\n   check that this variable is set. In Mageia 'yes' is the default for new\n   installs of ZoneMInder.\n2. Changes have been made to /etc/httpd/conf/site.d/zoneminder.conf to\n   mitigate CVE-2016-10140. Make sure to accept the new configuration when\n   updating existing systems.\n","status":"published","published":"2017-06-09T23:05:58Z","modified":"2026-04-16T06:26:24.816066595Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}