CVE-2014-9248: Medium severity zenoss vulnerability
Published Dec 15, 2014
·Updated
Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406.
Affected Software
20 affected components
Zenoss Zenoss Core<=5.0.0
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Zenoss Zenoss Core=4.2.5
Zenoss Zenoss Core=5.0.0
Zenoss Zenoss Core=5.0.0-beta_1
Zenoss Zenoss Core=5.0.0-beta_2
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9248?
CVE-2014-9248 has a medium severity due to the potential for brute-force attacks on weak passwords.
2
How do I fix CVE-2014-9248?
To fix CVE-2014-9248, configure Zenoss Core to require complex passwords and implement account lockout policies.
3
What versions are affected by CVE-2014-9248?
CVE-2014-9248 affects all versions of Zenoss Core up to 5 Beta 3, including several earlier releases.
4
Can CVE-2014-9248 be exploited remotely?
Yes, CVE-2014-9248 can be exploited remotely by attackers to gain unauthorized access through brute-force attempts.
5
What should I do if I am using an affected version of Zenoss Core related to CVE-2014-9248?
If using an affected version of Zenoss Core for CVE-2014-9248, upgrade to the latest patched version and enforce strong password policies.