CVE-2012-10048: Zenoss 3.x showDaemonXMLConfig Command Execution
Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-10048?
CVE-2012-10048 has been classified as a high severity vulnerability due to its potential for command injection.
How do I fix CVE-2012-10048?
To fix CVE-2012-10048, you should upgrade Zenoss Core to the latest version that addresses the command injection vulnerability.
Who is affected by CVE-2012-10048?
CVE-2012-10048 affects all authenticated users of Zenoss Core 3.x who have access to the showDaemonXMLConfig endpoint.
What kind of vulnerability is CVE-2012-10048?
CVE-2012-10048 is a command injection vulnerability that allows attackers to execute arbitrary commands on the server.
Can CVE-2012-10048 be exploited remotely?
Yes, CVE-2012-10048 can be exploited remotely by authenticated users with access to the affected endpoint.