CVE-2020-25729: 
NixOS vulnerability analysis and mitigation

ZoneMinder before version 1.34.21 was discovered to have a Cross-Site Scripting (XSS) vulnerability via the connkey parameter in download.php or export.php files. The vulnerability was disclosed on September 17, 2020 (NVD, MITRE).

The vulnerability exists due to insufficient sanitization of the connkey parameter in download.php and export.php files. The issue was fixed by implementing proper input validation using the validInt() function to sanitize the connkey parameter (GitHub Commit). The vulnerability has been assigned a CVSS v3.1 score of 6.1 (Medium severity) (NVD).

The Cross-Site Scripting vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the victim's browser session. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated user.

The vulnerability can be exploited by manipulating the connkey parameter in requests to the download.php or export.php endpoints. An attacker would need to craft a specific payload and convince a user to interact with a malicious URL or request.

The vulnerability was patched in ZoneMinder version 1.34.21. Users are advised to upgrade to this version or later to address the security issue (GitHub Release).