PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5367 Zoneminder CVE debrief

CVE-2017-5367 is a reflected cross-site scripting issue affecting ZoneMinder v1.29 and v1.30. According to the CVE/NVD record, multiple form and link input parameters in /zm/index.php can be abused to inject script that runs in an authenticated client’s browser. The issue was publicly disclosed on 2017-02-06 and was assigned a medium-severity CVSS 3.0 score of 6.1.

Vendor
Zoneminder
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-06
Original CVE updated
2026-05-13
Advisory published
2017-02-06
Advisory updated
2026-05-13

Who should care

Administrators and operators of ZoneMinder deployments, especially instances still running v1.29 or v1.30. Security teams should also care if the application is exposed to authenticated users in shared or high-trust browser sessions, since the impact depends on user interaction and browser context.

Technical summary

The NVD record classifies the weakness as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is reflected XSS in the ZoneMinder web interface, centered on /zm/index.php, where multiple request parameters can reflect attacker-controlled content into a page viewed by an authenticated user. The published CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, low complexity, required user interaction, and limited confidentiality/integrity impact through browser-side script execution.

Defensive priority

Moderate. This is not marked as KEV in the supplied data, but it is a publicly disclosed browser-side injection issue affecting authenticated users. Priority should be higher for internet-facing or multi-user ZoneMinder deployments.

Recommended defensive actions

  • Upgrade or otherwise remediate ZoneMinder instances running v1.29 or v1.30 before relying on them for production use.
  • Review and harden any authentication-dependent workflows in ZoneMinder that render request parameters into HTML.
  • Apply server-side output encoding and input handling controls consistent with preventing reflected XSS.
  • Limit exposure of the ZoneMinder web interface to trusted networks and authenticated administrative users where possible.
  • Monitor and test for unsafe reflection in /zm/index.php and related request-handling paths during validation and patch verification.

Evidence notes

All core claims are supported by the supplied CVE/NVD record: affected versions v1.29 and v1.30, the /zm/index.php location, reflected XSS behavior, CWE-79 mapping, and the CVSS 3.0 vector. Timing context comes from the CVE publishedAt value of 2017-02-06T17:59:00.500Z and modifiedAt of 2026-05-13T00:24:29.033Z. Reference links in the source metadata point to the CVE record, NVD detail page, and related advisory/index references.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5367 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5367

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5367 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5367

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.