CVE-2014-6257: Medium severity zenoss vulnerability
Published Dec 15, 2014
·Updated
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an object helper method, aka ZEN-15407.
Affected Software
20 affected components
Zenoss Zenoss Core<=5.0.0
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Zenoss Zenoss Core=4.2.5
Zenoss Zenoss Core=5.0.0
Zenoss Zenoss Core=5.0.0-beta_1
Zenoss Zenoss Core=5.0.0-beta_2
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6257?
CVE-2014-6257 is classified as a medium severity vulnerability.
2
How do I fix CVE-2014-6257?
To fix CVE-2014-6257, upgrade to Zenoss Core version 5 or apply the appropriate patches recommended by Zenoss.
3
What versions of Zenoss Core are affected by CVE-2014-6257?
CVE-2014-6257 affects Zenoss Core versions 2.4.0 through 5.0.0 Beta 3.
4
What type of attack can exploit CVE-2014-6257?
CVE-2014-6257 allows remote attackers to bypass access restrictions through specific web-endpoint URLs.
5
Is there a workaround for CVE-2014-6257?
While a permanent fix is preferred, limiting access to the Zenoss Core instance can serve as a temporary workaround for CVE-2014-6257.