CVE-2014-9252: Infoleak
Published Dec 15, 2014
·Updated
Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive information by reading database entries, aka ZEN-15416.
Affected Software
20 affected components
Zenoss Zenoss Core<=5.0.0
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Zenoss Zenoss Core=4.2.5
Zenoss Zenoss Core=5.0.0
Zenoss Zenoss Core=5.0.0-beta_1
Zenoss Zenoss Core=5.0.0-beta_2
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9252?
CVE-2014-9252 is considered a high severity vulnerability due to the exposure of cleartext passwords.
2
How do I fix CVE-2014-9252?
To fix CVE-2014-9252, update Zenoss Core to a version that no longer stores passwords in cleartext.
3
Which versions of Zenoss Core are affected by CVE-2014-9252?
CVE-2014-9252 affects Zenoss Core versions up to and including 5 Beta 3, as well as older versions like 2.4.0 and others.
4
Are local users able to exploit CVE-2014-9252?
Yes, local users can exploit CVE-2014-9252 by accessing the session database to retrieve sensitive information.
5
What type of information is compromised in CVE-2014-9252?
CVE-2014-9252 compromises sensitive information in the form of cleartext passwords stored in the session database.