This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10206 →

DEBIAN-CVE-2016-10206

Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for reque...

Original description

The description as published by the source.

Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

Debian:13 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

Debian:14 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

References

advisory security-tracker.debian.org