CVE-2014-6260

Zenoss Core < 5.0.0 - Unauthenticated Remote Code Execution via Pager Command String

Title source: llm
STIX 2.1

Description

Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation, aka ZEN-15412.

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/449452

Scores

EPSS 0.0177
EPSS Percentile 75.4%

Details

CWE
CWE-77
Status published
Products (18)
zenoss/zenoss_core 2.4.0
zenoss/zenoss_core 2.4.5
zenoss/zenoss_core 2.5.0
zenoss/zenoss_core 2.5.1
zenoss/zenoss_core 2.5.2
zenoss/zenoss_core 3.0.0
zenoss/zenoss_core 3.0.1
zenoss/zenoss_core 3.0.2
zenoss/zenoss_core 3.0.3
zenoss/zenoss_core 3.1.0
... and 8 more
Published Dec 15, 2014
Tracked Since Feb 18, 2026