Back to Database
Status published
Critical
CVE-2022-39289
Database log access in ZoneMinder
Vulnerability Description
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39289
Credits & Attribution
No credits recorded in the NVD database.
References
More from ZoneMinder
View All →CVE-2024-51482
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
Critical
10
CVE-2024-43360
ZoneMinder Time-based SQL Injection
Critical
9.8
CVE-2024-43359
XSS vulnerabilities in montagereview
Unknown
0
CVE-2024-43358
XSS vulnerability in filter view
Medium
6.1
CVE-2023-41884
ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php
High
7.1
Affected Vendor
ZoneMinder
View all reports →Affected Software
zoneminder
Vulnerable Versions:
< 1.36.27, >= 1.37.0, < 1.37.24
Timeline
Official Publish:
October 7th, 2022
Last Modified:
April 22nd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
MITRE ATT&CK TTPs
T1213
Data from Information Repositories
Collection
T1005
Data from Local System
Collection
T1552
Unsecured Credentials
Credential Access
T1041
Exfiltration Over C2 Channel
Exfiltration
T1190
Exploit Public-Facing Application
Initial Access
T1078
Valid Accounts
Persistence
T1556
Modify Authentication Process
Credential Access