CVE-2024-43359: 
NixOS vulnerability analysis and mitigation

ZoneMinder, a free and open-source closed-circuit television software application, was found to contain a cross-site scripting (XSS) vulnerability in the montagereview feature. The vulnerability affects versions up to 1.36.33 and 1.37.60, and was discovered in August 2024. The security flaw exists in the handling of displayinterval, speed, and scale parameters (GitHub Advisory, NVD).

The vulnerability is classified as a cross-site scripting (XSS) issue, identified as CVE-2024-43359. According to the National Vulnerability Database, it received a CVSS v3.1 base score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability specifically affects the montagereview functionality through improper handling of the displayinterval, speed, and scale parameters (NVD).

The vulnerability allows attackers to execute arbitrary HTML or JavaScript code in the context of the user's browser session. This could potentially lead to unauthorized access to sensitive information, session hijacking, or other malicious actions performed under the context of the affected user (GitHub Advisory).

The vulnerability can be exploited through specially crafted URLs containing malicious input in the displayinterval, speed, and scale parameters. Proof-of-concept examples demonstrate successful exploitation through manipulated parameter values that trigger JavaScript execution (GitHub Advisory).

The vulnerability has been patched in ZoneMinder versions 1.36.34 and 1.37.61. The fix involves proper sanitization of the displayinterval, speed, and scale parameters. For users unable to upgrade immediately, manually applying commit 6cc64dd is suggested as a workaround (GitHub Advisory).