Medium
zoneminder — security advisory
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
- Products
- zoneminder
- Affected versions
- 1.32.3-2build1, 1.32.3-2ubuntu1, 1.32.3-2ubuntu2, 1.32.3-2ubuntu2+esm1, 1.36.10+dfsg1-1, 1.36.11+dfsg1-1, 1.36.12+dfsg1-1, 1.36.12+dfsg1-1ubuntu0.1~esm1, 1.36.33+dfsg1-1build1, 1.36.33+dfsg1-1build2, 1.36.33+dfsg1-1build3, 1.36.33+dfsg1-1build4, 1.36.35+dfsg1-1, 1.36.37+dfsg1-1, 1.36.7+dfsg1-1
- Fixed versions
- Not specified
- CVEs
- CVE-2019-7336
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:51 UTC · Revision 1
Source evidence
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
osv:UBUNTU-CVE-2019-7336
zoneminder
Fixed versions: Not specified
zoneminder
Fixed versions: Not specified
zoneminder
Fixed versions: Not specified
zoneminder
Fixed versions: Not specified
zoneminder
Fixed versions: Not specified
zoneminder
Fixed versions: Not specified
Complete source record
{
"id": "192962c12d1286f2015d4d233591eea548066c62e732b9e2912e0b5772138a47",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-7336",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2019-7336",
"summary": "Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.",
"evidence": "osv:UBUNTU-CVE-2019-7336",
"products": [
{
"name": {
"value": "zoneminder",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.32.3-2build1",
"evidence": "/affected/0/versions"
},
{
"value": "1.32.3-2ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.32.3-2ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "1.32.3-2ubuntu2+esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "zoneminder",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.36.7+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.36.10+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.36.11+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.36.12+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.36.12+dfsg1-1ubuntu0.1~esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "zoneminder",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.36.33+dfsg1-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "1.36.33+dfsg1-1build2",
"evidence": "/affected/2/versions"
},
{
"value": "1.36.33+dfsg1-1build3",
"evidence": "/affected/2/versions"
},
{
"value": "1.36.33+dfsg1-1build4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "zoneminder",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.36.35+dfsg1-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "zoneminder",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.36.37+dfsg1-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "zoneminder",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.36.35+dfsg1-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.36.37+dfsg1-1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2019-7336",
"aliases": [
"UBUNTU-CVE-2019-7336"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zoneminder",
"purl": "pkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"1.32.3-2build1",
"1.32.3-2ubuntu1",
"1.32.3-2ubuntu2",
"1.32.3-2ubuntu2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-7336.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "zoneminder",
"binary_version": "1.32.3-2ubuntu2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zoneminder",
"purl": "pkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"1.36.7+dfsg1-1",
"1.36.10+dfsg1-1",
"1.36.11+dfsg1-1",
"1.36.12+dfsg1-1",
"1.36.12+dfsg1-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-7336.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "zoneminder",
"binary_version": "1.36.12+dfsg1-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zoneminder",
"purl": "pkg:deb/ubuntu/zoneminder?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.36.33+dfsg1-1build1",
"1.36.33+dfsg1-1build2",
"1.36.33+dfsg1-1build3",
"1.36.33+dfsg1-1build4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-7336.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "zoneminder",
"binary_version": "1.36.33+dfsg1-1build4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zoneminder",
"purl": "pkg:deb/ubuntu/zoneminder?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.36.35+dfsg1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-7336.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "zoneminder",
"binary_version": "1.36.35+dfsg1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zoneminder",
"purl": "pkg:deb/ubuntu/zoneminder?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.36.37+dfsg1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-7336.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "zoneminder",
"binary_version": "1.36.37+dfsg1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zoneminder",
"purl": "pkg:deb/ubuntu/zoneminder?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.36.35+dfsg1-1",
"1.36.37+dfsg1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-7336.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "zoneminder",
"binary_version": "1.36.37+dfsg1-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:09.854131157Z",
"provider": "osv",
"upstream": [
"CVE-2019-7336"
],
"references": [
"https://ubuntu.com/security/CVE-2019-7336",
"https://github.com/ZoneMinder/zoneminder/issues/2457",
"https://www.cve.org/CVERecord?id=CVE-2019-7336"
]
},
"related_cves": [
{
"value": "CVE-2019-7336",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354899,
"published_at": "2019-02-04T19:29:00+00:00"
}