CVE-2014-6255: Medium severity zenoss vulnerability
Published Dec 15, 2014
·Updated
Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the camefrom parameter, aka ZEN-11998.
Affected Software
16 affected components
Zenoss Zenoss Core<=4.2.5
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6255?
CVE-2014-6255 is considered a medium severity vulnerability due to its potential for phishing attacks via open redirects.
2
How do I fix CVE-2014-6255?
To fix CVE-2014-6255, update Zenoss Core to version 4.2.5 or later.
3
Who is affected by CVE-2014-6255?
CVE-2014-6255 affects all versions of Zenoss Core prior to 4.2.5 and specific versions such as 2.4.0, 2.4.5, 2.5.0, 3.0.0 to 3.2.1, and 4.2.0 to 4.2.4.
4
What can attackers do using CVE-2014-6255?
Attackers can exploit CVE-2014-6255 to redirect users to arbitrary websites, leading to possible phishing attacks.
5
When was CVE-2014-6255 disclosed?
CVE-2014-6255 was disclosed in September 2014.