Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation, aka ZEN-15412.
References
Link | Resource |
---|---|
http://www.kb.cert.org/vuls/id/449452 | Third Party Advisory US Government Resource |
https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2014-12-15 18:59
Updated : 2024-02-28 12:20
NVD link : CVE-2014-6260
Mitre link : CVE-2014-6260
CVE.ORG link : CVE-2014-6260
JSON object : View
Products Affected
zenoss
- zenoss_core
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')