CVE-2022-39289

Database log access in ZoneMinder

State: Published
Severity: 9.1 Critical
Published: Oct 7, 2022
Updated: Apr 22, 2025
Reserved: Sep 2, 2022

Description

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-287 Improper Authentication

Affected Products

Product	Versions
zoneminderZoneMinder	< 1.36.27Affected >= 1.37.0, < 1.37.24Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.