CVE-2014-6253: CSRF
Published Dec 15, 2014
·Updated
Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authentication of arbitrary users, aka ZEN-12653.
Affected Software
20 affected components
Zenoss Zenoss Core<=5.0.0
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Zenoss Zenoss Core=4.2.5
Zenoss Zenoss Core=5.0.0
Zenoss Zenoss Core=5.0.0-beta_1
Zenoss Zenoss Core=5.0.0-beta_2
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6253?
CVE-2014-6253 has a moderate severity as it allows for cross-site request forgery attacks affecting user authentication.
2
How do I fix CVE-2014-6253?
To fix CVE-2014-6253, update Zenoss Core to the latest version that does not have this vulnerability.
3
Who is affected by CVE-2014-6253?
CVE-2014-6253 affects users running Zenoss Core versions up to and including 5 Beta 3.
4
What types of attacks can CVE-2014-6253 enable?
CVE-2014-6253 can enable remote attackers to hijack the authentication of users through CSRF attacks.
5
Is there a workaround for CVE-2014-6253 if I cannot update immediately?
A potential workaround for CVE-2014-6253 is to implement CSRF protections within your application until an update can be applied.