Published: 13/01/2017 Updated: 16/03/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated malicious user to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zoneminder zoneminder 1.30.0

Debian Bug report logs - #851710 zoneminder: CVE-2016-10140 Package: src:zoneminder; Maintainer for src:zoneminder is Dmitry Smirnov <onlyjob@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 17 Jan 2017 20:39:02 UTC Severity: grave Tags: patch, security, upstream Found in version zonemin ...

Various ZoneMinder versions suffer from authentication bypass, cross site request forgery, cross site scripting, information disclosure, and file disclosure vulnerabilities ...

Zoneminder 未授权访问批量检测工具：ZoneMinder v1.30和v1.29捆绑的Apache HTTP Server配置中存在信息泄露和认证绕过漏洞，允许远程未认证攻击者浏览web根目录下的所有目录。

Zoneminder 未授权访问（CVE-2016-10140）Poc--批量验证脚本漏洞描述 ZoneMinder是一款开源视频监控系统当异常事件发生时，你就可以收到e-mail或简讯通知。ZoneMinder v130和v129捆绑的Apache HTTP Server配置中存在信息泄露和认证绕过漏洞，允许远程未认证攻击者浏览web根目录下的所有目录。 FOFA语法 a

CWE-200 https://github.com/ZoneMinder/ZoneMinder/pull/1697 https://github.com/ZoneMinder/ZoneMinder/commit/71898df7565ed2a51dfe76a1cf30ddb81fc888ba http://seclists.org/fulldisclosure/2017/Feb/11 http://seclists.org/bugtraq/2017/Feb/6 http://www.securityfocus.com/bid/96849 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851710 https://nvd.nist.gov https://github.com/asaotomo/CVE-2016-10140-Zoneminder-Poc

CVE-2016-10140

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect