Lucene search
HistoryDec 15, 2014 - 6:59 p.m.
CVE-2014-9386
cve-2014-9386
zenoss core
security vulnerability
session hijacking
nvd
zen-12691
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6.9 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
77.0%
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.
Affected configurations
Node
zenosszenoss_coreRange≤4.2.5
ORzenosszenoss_coreMatch2.4.0
ORzenosszenoss_coreMatch2.4.5
ORzenosszenoss_coreMatch2.5.0
ORzenosszenoss_coreMatch2.5.1
ORzenosszenoss_coreMatch2.5.2
ORzenosszenoss_coreMatch3.0.0
ORzenosszenoss_coreMatch3.0.1
ORzenosszenoss_coreMatch3.0.2
ORzenosszenoss_coreMatch3.0.3
ORzenosszenoss_coreMatch3.1.0
ORzenosszenoss_coreMatch3.2.0
ORzenosszenoss_coreMatch3.2.1
ORzenosszenoss_coreMatch4.2.0
ORzenosszenoss_coreMatch4.2.3
ORzenosszenoss_coreMatch4.2.4
Related
nvd
nvd
CVE-2014-9386
2014-12-15 18:59:28
CVE-2014-9246
2014-12-15 18:59:21
prion
prion
Cross site scripting
2014-12-15 18:59:00
Design/Logic Flaw
2014-12-15 18:59:00
cvelist
cvelist
CVE-2014-9386
2014-12-15 17:27:00
cve
cve
CVE-2014-9246
2014-12-15 18:59:21
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6.9 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
77.0%
Related for CVE-2014-9386