6.8

CVE-2014-9386

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.

Data is provided by the National Vulnerability Database (NVD)
Zenoss ≫ Zenoss Core Version <= 4.2.5
Zenoss ≫ Zenoss Core Version2.4.0
Zenoss ≫ Zenoss Core Version2.4.5
Zenoss ≫ Zenoss Core Version2.5.0
Zenoss ≫ Zenoss Core Version2.5.1
Zenoss ≫ Zenoss Core Version2.5.2
Zenoss ≫ Zenoss Core Version3.0.0
Zenoss ≫ Zenoss Core Version3.0.1
Zenoss ≫ Zenoss Core Version3.0.2
Zenoss ≫ Zenoss Core Version3.0.3
Zenoss ≫ Zenoss Core Version3.1.0
Zenoss ≫ Zenoss Core Version3.2.0
Zenoss ≫ Zenoss Core Version3.2.1
Zenoss ≫ Zenoss Core Version4.2.0
Zenoss ≫ Zenoss Core Version4.2.3
Zenoss ≫ Zenoss Core Version4.2.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.71% 0.701
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
http://www.kb.cert.org/vuls/id/449452
Third Party Advisory
US Government Resource