NVD

Id
81630  
Name
CVE-2017-5367  
Description
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample parameters could include action=login&view=postlogin[XSS] view=console[XSS] view=groups[XSS] view=events&filter[terms][1][cnj]=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=and[XSS] view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=[XSS]and view=events&limit=1%22%3E%3C/a%3E[XSS] (among others).  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-02-15  
Published
2017-02-06  
Modified Date
2017-02-09  
Seq
2017-5367  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
404726 81630 CVE-2017-3409 http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html  View
404727 81630 CVE-2017-3409 95531  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
65101 JVNDB-2017-001479 ZoneMinder における反射型クロスサイトスクリプティングの脆弱性 ZoneMinder の form および link input パラメータには、反射型クロスサイトスクリプティングの脆弱性が存在します。 CVE-2017-5367 CVE-2017-5367 81630 4.3 6.1 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-001479.html 2017-02-05 2017-02-23 View