CVE-2022-30768: 
NixOS vulnerability analysis and mitigation

A Stored Cross Site Scripting (XSS) vulnerability exists in ZoneMinder version 1.36.12 and earlier, identified as CVE-2022-30768. The vulnerability was discovered in 2022 and affects the Username field functionality in the ZoneMinder application. When exploited, it allows attackers to execute HTML or JavaScript code when an administrator or users with sufficient privileges click on the Logout function (NVD).

The vulnerability exists due to insufficient input validation and sanitization of the Username field. When a malicious user creates or modifies a username containing XSS payload, the code remains stored in the system. The payload gets executed when an administrator or users with permissions to view logged-in users attempt to logout from the platform. The execution occurs because the logout function displays the list of currently logged-in users, which includes the malicious username (Medium Blog).

The vulnerability allows attackers to execute arbitrary HTML or JavaScript code in the context of other users' browsers, particularly administrators. This could lead to session hijacking, credential theft, or other malicious actions performed with the privileges of the affected user (NVD).

The vulnerability has been patched in ZoneMinder version 1.36.13 and later releases. Organizations should upgrade to the latest version to protect against this vulnerability. The fix includes proper input validation and sanitization of the Username field (ZoneMinder Releases).