CVE-2014-9386: Medium severity zenoss vulnerability
Published Dec 15, 2014
·Updated
Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.
Affected Software
16 affected components
Zenoss Zenoss Core<=4.2.5
Zenoss Zenoss Core=2.4.0
Zenoss Zenoss Core=2.4.5
Zenoss Zenoss Core=2.5.0
Zenoss Zenoss Core=2.5.1
Zenoss Zenoss Core=2.5.2
Zenoss Zenoss Core=3.0.0
Zenoss Zenoss Core=3.0.1
Zenoss Zenoss Core=3.0.2
Zenoss Zenoss Core=3.0.3
Zenoss Zenoss Core=3.1.0
Zenoss Zenoss Core=3.2.0
Zenoss Zenoss Core=3.2.1
Zenoss Zenoss Core=4.2.0
Zenoss Zenoss Core=4.2.3
Zenoss Zenoss Core=4.2.4
Event History
Dec 15, 2014
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9386?
CVE-2014-9386 is considered a medium severity vulnerability due to its potential for session hijacking.
2
How do I fix CVE-2014-9386?
To fix CVE-2014-9386, upgrade Zenoss Core to version 4.2.5 SP161 or later.
3
What are the implications of CVE-2014-9386?
CVE-2014-9386 can allow remote attackers to hijack user sessions if the session ID cookie has an infinite lifetime.
4
Which versions of Zenoss Core are affected by CVE-2014-9386?
CVE-2014-9386 affects Zenoss Core versions prior to 4.2.5 SP161, including versions 2.4.0 to 4.2.4.
5
Can I mitigate CVE-2014-9386 without upgrading?
Mitigating CVE-2014-9386 without upgrading is challenging, but you can implement strict session management practices.