CVE-2019-7346

HIGH

ZoneMinder <= 1.32.3 - Cross-Site Request Forgery via Failed Request Retry

Title source: llm
STIX 2.1

Description

A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/ZoneMinder/zoneminder/issues/2469

Scores

CVSS v3 8.8
EPSS 0.0066
EPSS Percentile 46.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
zoneminder/zoneminder < 1.32.3
Published Feb 04, 2019
Tracked Since Feb 18, 2026