CVE-2014-9385: CSRF

Published Dec 15, 2014

Updated

Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger arbitrary code execution via a ZenPack upload, aka ZEN-15388.

Affected Software

20 affected components

Zenoss Zenoss Core=2.4.0

Zenoss Zenoss Core=2.4.5

Zenoss Zenoss Core=2.5.0

Zenoss Zenoss Core=2.5.1

Zenoss Zenoss Core=2.5.2

Zenoss Zenoss Core=3.0.0

Zenoss Zenoss Core=3.0.1

Zenoss Zenoss Core=3.0.2

Zenoss Zenoss Core=3.0.3

Zenoss Zenoss Core=3.1.0

Zenoss Zenoss Core=3.2.0

Zenoss Zenoss Core=3.2.1

Zenoss Zenoss Core=4.2.0

Zenoss Zenoss Core=4.2.3

Zenoss Zenoss Core=4.2.4

Zenoss Zenoss Core=4.2.5

Zenoss Zenoss Core=5.0.0

Zenoss Zenoss Core=5.0.0-beta_1

Zenoss Zenoss Core=5.0.0-beta_2

Zenoss Zenoss Core=5.0.0-beta_3

Event History

Dec 15, 2014

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9385?

CVE-2014-9385 has a medium severity rating due to its potential for exploitation through CSRF attacks.

How do I fix CVE-2014-9385?

To fix CVE-2014-9385, it is recommended to upgrade Zenoss Core to a version that is not vulnerable, specifically after 5 Beta 3.

What types of attacks does CVE-2014-9385 allow?

CVE-2014-9385 allows attackers to hijack user authentication and execute arbitrary code via a ZenPack upload.

Which versions of Zenoss Core are affected by CVE-2014-9385?

CVE-2014-9385 affects multiple versions of Zenoss Core, specifically up to and including 5 Beta 3.

Is user interaction required to exploit CVE-2014-9385?

No, CVE-2014-9385 can be exploited without any user interaction, making it particularly dangerous.