CVE-2019-7350: Zoneminder

High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days.

Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.

Affected products

• Zoneminder Zoneminder: up to and including 1.32.3

Published 2019-02-04. Last modified 2026-06-17.