CVE-2014-6260

Published Dec 15, 2014

Last updated 9 years ago

Overview

Description
Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation, aka ZEN-15412.
Source
cve@mitre.org
NVD status
Analyzed

Risk scores

CVSS 2.0

Type
Primary
Base score
6.8
Impact score
6.4
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
CWE-77

Social media

Hype score
Not currently trending

Vendor comments

  • ZenossAddressed in versions 5.1.1, 4.2.5.SP650, and 4.2.4.SP854

Configurations