CVE-2014-9247: Infoleak
Published Dec 15, 2014
·Updated
Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role information by visiting the ZenUsers (aka User Manager) page, aka ZEN-15389.
Affected Software
20 affected components
Zenoss Zenoss Core<=5.0.0
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Zenoss Zenoss Core=4.2.5
Zenoss Zenoss Core=5.0.0
Zenoss Zenoss Core=5.0.0-beta_1
Zenoss Zenoss Core=5.0.0-beta_2
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9247?
CVE-2014-9247 is classified as a medium severity vulnerability due to unauthorized access to sensitive user information.
2
How do I fix CVE-2014-9247?
To fix CVE-2014-9247, upgrade to Zenoss Core version 5.1.0 or later that patches this vulnerability.
3
What types of data are exposed by CVE-2014-9247?
CVE-2014-9247 exposes sensitive information including user accounts, email addresses, and user roles.
4
Who is affected by CVE-2014-9247?
CVE-2014-9247 affects all versions of Zenoss Core up to and including version 5.0.0.
5
Can CVE-2014-9247 be exploited by unauthenticated users?
No, CVE-2014-9247 requires authentication, meaning only authenticated users can exploit this vulnerability.