CVE-2014-9386

Опубликовано: 15 дек. 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.

Комментарий

CWE-384: Session Fixation

Ссылки

http://www.kb.cert.org/vuls/id/449452
Third Party Advisory
US Government Resource
https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing
Vendor Advisory
http://www.kb.cert.org/vuls/id/449452
Third Party Advisory
US Government Resource
https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zenoss:zenoss_core:*:*:*:*:*:*:*:*

Версия до 4.2.5 (включая)

cpe:2.3:a:zenoss:zenoss_core:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:2.4.5:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:2.5.0:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:2.5.2:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:zenoss:zenoss_core:4.2.4:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00712

Низкий

6.8 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2014-9386

debian

около 11 лет назад

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the sessi ...

GHSA-9758-jmvx-p2c5

github

больше 3 лет назад