Lucene search
HistoryDec 15, 2014 - 6:59 p.m.
CVE-2014-9386
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6.6 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
76.9%
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.
Affected configurations
Node
zenosszenoss_coreRange≤4.2.5
ORzenosszenoss_coreMatch2.4.0
ORzenosszenoss_coreMatch2.4.5
ORzenosszenoss_coreMatch2.5.0
ORzenosszenoss_coreMatch2.5.1
ORzenosszenoss_coreMatch2.5.2
ORzenosszenoss_coreMatch3.0.0
ORzenosszenoss_coreMatch3.0.1
ORzenosszenoss_coreMatch3.0.2
ORzenosszenoss_coreMatch3.0.3
ORzenosszenoss_coreMatch3.1.0
ORzenosszenoss_coreMatch3.2.0
ORzenosszenoss_coreMatch3.2.1
ORzenosszenoss_coreMatch4.2.0
ORzenosszenoss_coreMatch4.2.3
ORzenosszenoss_coreMatch4.2.4
Related
prion
prion
Cross site scripting
2014-12-15 18:59:00
Design/Logic Flaw
2014-12-15 18:59:00
cve
cve
CVE-2014-9386
2014-12-15 18:59:28
CVE-2014-9246
2014-12-15 18:59:21
cvelist
cvelist
CVE-2014-9386
2014-12-15 17:27:00
nvd
nvd
CVE-2014-9246
2014-12-15 18:59:21
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
6.6 Medium
AI Score
Confidence
Low
0.005 Low
EPSS
Percentile
76.9%
Related for NVD:CVE-2014-9386