CVE-2019-7350 : What You Need to Know

ZoneMinder through version 1.32.3 is affected by a session fixation vulnerability that allows attackers to hijack user accounts by fixing their session cookies onto the next logged-in user.

Understanding CVE-2019-7350

What is CVE-2019-7350?

ZoneMinder, up to version 1.32.3, contains a session fixation vulnerability where an attacker can manipulate session cookies to gain unauthorized access to a victim's account.

The Impact of CVE-2019-7350

This vulnerability enables attackers to fixate their session cookies onto the next user who logs in, leading to unauthorized access to victim accounts.

Technical Details of CVE-2019-7350

Vulnerability Description

Session fixation vulnerability in ZoneMinder up to version 1.32.3 allows attackers to hijack user accounts by manipulating session cookies.

Affected Systems and Versions

ZoneMinder versions up to 1.32.3 are impacted by this vulnerability.

Exploitation Mechanism

Attackers exploit the generation of multiple cookies upon successful login, overlapping with subsequent logins.

Mitigation and Prevention

Immediate Steps to Take

Upgrade ZoneMinder to version 1.32.4 or later to mitigate this vulnerability.
Monitor user sessions for any suspicious activity.

Long-Term Security Practices

Implement strong session management practices to prevent session fixation attacks.
Regularly audit and review session handling mechanisms.

Patching and Updates

Apply security patches promptly to address known vulnerabilities in ZoneMinder.