NVD

Id
81665  
Name
CVE-2017-5595  
Description
A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request.  
Reject
 
CVSS Version
2  
CVSS Score
2.1  
Severity
Low  
CVSS Base Score
2.1  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-02-28  
Published
2017-02-06  
Modified Date
2017-02-16  
Seq
2017-5595  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
404812 81665 CVE-2017-3792 95787  View
404813 81665 CVE-2017-3792 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-telepresence  View
404814 81665 CVE-2017-3792 95787  View
404815 81665 CVE-2017-3792 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-telepresence  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
65230 JVNDB-2017-001597 ZoneMinder の web/views/file.php におけるファイル公開/インクルージョンの脆弱性 ZoneMinder の web/views/file.php は、フィルタされていないユーザの入力が readfile() に渡されるため、ファイル公開/インクルージョンの脆弱性が存在します。 CVE-2017-5595 CVE-2017-5595 81665 2.1 5.5 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-001597.html 2017-01-25 2017-03-07 View