8.8high
CVE-2016-10206
Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of user…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known
Summary
Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.
Exploit prediction (EPSS)
0.69% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- openwall.com /lists/oss-security/2017/02/05/1 · mailing-list, x_refsource_MLIST, x_transferred
- securityfocus.com /bid/97114 · vdb-entry, x_refsource_BID, x_transferred
- foxmole.com /advisories/foxmole-2016-07-05.txt · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-10206
- NVD: CVE-2016-10206
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.