CVE-2024-43360
Published: 12 August 2024
Summary
CVE-2024-43360 is a critical-severity SQL Injection (CWE-89) vulnerability in Zoneminder Zoneminder. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
ZoneMinder, an open source closed-circuit television application, contains a time-based SQL injection vulnerability tracked as CVE-2024-43360. The flaw is classified under CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with low attack complexity and no required credentials or user interaction. It affects versions prior to the patches released in 1.36.34 and 1.37.61.
An unauthenticated attacker with network access can supply crafted input that triggers time-based SQL injection, allowing extraction or manipulation of database contents and potentially leading to full compromise of confidentiality, integrity, and availability of the ZoneMinder installation.
The project addressed the issue through multiple commits that sanitize inputs and update query handling; the corresponding GitHub Security Advisory GHSA-9cmr-7437-v9fj and the fixed releases provide the authoritative remediation guidance. The associated EPSS score currently stands at 0.6325, matching its observed peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40249
Vulnerability details
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.