CVE-2008-1381

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-05-01 · updated 2026-06-16
Weakness: CWE-94

Description

ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.

Affected products

zoneminder: 0.0.1, 0.9.7, 0.9.8, 0.9.9, 0.9.10, 0.9.11 (+30)

References

http://secunia.com/advisories/29995
http://secunia.com/advisories/30189
http://www.awe.com/mark/blog/200804272230.html
http://www.securityfocus.com/bid/28968
http://www.zoneminder.com/wiki/index.php/Change_History#Release_1.23.3
https://exchange.xforce.ibmcloud.com/vulnerabilities/42046
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00078.html
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00085.html
http://secunia.com/advisories/29995
http://secunia.com/advisories/30189
http://www.awe.com/mark/blog/200804272230.html
http://www.securityfocus.com/bid/28968

Get alerted when CVE-2008-1381 or the next vulnerability affects your stack